alert dns $HOME_NET any -> any any (msg:"ET MALWARE BrushaLoader CnC DNS Lookup"; dns.query; content:"macmall.fun"; nocase; endswith; reference:url,blog.talosintelligence.com/2019/02/combing-through-brushaloader.html; classtype:command-and-control; sid:2026959; rev:3; metadata:created_at 2019_02_21, malware_family BrushaLoader, confidence Medium, signature_severity Major, updated_at 2020_09_16;)