alert dns $HOME_NET any -> any any (msg:"ET MALWARE FrameworkPOS Covert DNS CnC Initial Check In"; dns.query; content:".grp"; nocase; offset:8; depth:4; content:".ping.adm"; fast_pattern; within:15; reference:url,threatstream.com/blog/three-month-frameworkpos-malware-campaign-nabs-43000-credits-cards-from-point-of-sale-systems; reference:md5,591e820591e10500fe939d6bd50e6776; classtype:command-and-control; sid:2022559; rev:4; metadata:created_at 2016_02_23, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_09_01;)