alert dns $HOME_NET any -> any any (msg:"ET MALWARE MirrorThief CnC in DNS Lookup"; dns.query; content:"jqueryextd.at"; nocase; endswith; reference:url,blog.netlab.360.com/xin-yong-qia-shu-ju-xie-lou-chi-xu-jin-xing-zhong/; classtype:command-and-control; sid:2027356; rev:3; metadata:created_at 2019_05_15, deployment Perimeter, malware_family MirrorThief, performance_impact Low, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_09_17;)