alert dns $HOME_NET any -> any any (msg:"ET MALWARE BrushaLoader CnC DNS Lookup"; dns.query; content:"faxpctodaymessage"; nocase; pcre:"/^\.(?:space|press|website)$/R"; reference:url,blog.talosintelligence.com/2019/02/combing-through-brushaloader.html; classtype:command-and-control; sid:2026952; rev:3; metadata:created_at 2019_02_21, deployment Perimeter, malware_family BrushaLoader, performance_impact Low, confidence Medium, signature_severity Major, updated_at 2020_08_27;)