alert dns $HOME_NET any -> any any (msg:"ET MALWARE BrushaLoader CnC DNS Lookup"; dns.query; content:"mantorsagcoloms.club"; nocase; endswith; reference:url,blog.talosintelligence.com/2019/02/combing-through-brushaloader.html; classtype:command-and-control; sid:2026961; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, created_at 2019_02_21, malware_family BrushaLoader, confidence Medium, signature_severity Major, updated_at 2020_09_16;)