alert dns any any -> $HOME_NET any (msg:"ET MALWARE DNS Reply Sinkhole - Anubis - 195.22.26.192/26"; content:"|00 01 00 01|"; content:"|00 04 c3 16 1a|"; distance:4; within:5; byte_test:1,>,224,0,relative; content:!"|0e|anubisnetworks|03|com|00|"; nocase; content:!"|05|mpsmx|03|net|00|"; nocase; content:!"|09|mailspike|03|com|00|"; nocase; content:!"|09|mailspike|03|org|00|"; nocase; threshold:type limit, track by_src, seconds 60, count 1; classtype:trojan-activity; sid:2018455; rev:6; metadata:created_at 2014_05_08, confidence High, signature_severity Major, updated_at 2022_07_13, reviewed_at 2024_03_06;)