alert dns $HOME_NET any -> any any (msg:"ET HUNTING All Numerical .ru Domain Lookup Likely Malware Related"; dns.query; content:".ru"; endswith; fast_pattern; pcre:"/^(?:[0-9]{2,30})\x2eru$/i"; content:!"101.ru"; endswith; content:!"9366858.ru"; endswith; classtype:misc-activity; sid:2012328; rev:9; metadata:created_at 2011_02_21, deployment Perimeter, deployment Internal, deprecation_reason Performance, performance_impact Significant, confidence Medium, signature_severity Informational, updated_at 2024_03_26;)