alert dns $HOME_NET any -> any any (msg:"ET MALWARE OWAReaper DNS Tunnel Exfiltration via DNS Lookup (asecdns .com)"; dns.query; content:".asecdns.com"; fast_pattern; content:!".doh."; content:!".dot."; pcre:"/(?:[a-v0-9]+\x2e){2,4}asecdns.com/"; classtype:domain-c2; sid:2071335; rev:1; metadata:attack_target Client_Endpoint, created_at 2026_07_28, deployment Perimeter, malware_family OWAReaper, confidence High, signature_severity Major, tag c2, updated_at 2026_07_28, former_sid 2868083, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1071, mitre_technique_name Application_Layer_Protocol_DNS;)