alert dns $HOME_NET any -> any any (msg:"ET POLICY Android Adups Firmware DNS Query 4"; dns.query; content:"bigdata.advmob.cn"; nocase; endswith; reference:url,www.kryptowire.com/adups_security_analysis.html; classtype:policy-violation; sid:2023518; rev:4; metadata:affected_product Android, attack_target Mobile_Client, created_at 2016_11_16, deployment Perimeter, confidence High, signature_severity Informational, tag Android, updated_at 2020_09_15;)