alert dns $HOME_NET any -> any any (msg:"ET MALWARE Cryptowall 3.0 .onion Proxy Domain"; dns.query; content:"paytoc4gtpn5czl2"; depth:16; nocase; fast_pattern; reference:url,malware.dontneedcoffee.com/2015/01/guess-whos-back-again-cryptowall-30.html; classtype:trojan-activity; sid:2020182; rev:4; metadata:created_at 2015_01_15, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_09_01;)