alert dns $HOME_NET any -> any any (msg:"ET POLICY DNS Query to .onion proxy Domain (onion.cab)"; dns.query; content:".onion.cab"; fast_pattern; nocase; endswith; reference:md5,de81fab8ec96bef76db828f4c1a42e4d; classtype:policy-violation; sid:2018876; rev:8; metadata:created_at 2014_08_01, deprecation_reason Age, confidence Medium, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_04_19, reviewed_at 2024_04_19;)