alert dns $HOME_NET any -> any any (msg:"ET DELETED Query for Suspicious shell .now .sh Domain"; dns.query; content:"shell.now.sh"; nocase; endswith; reference:url,web.archive.org/web/20210411091242/https://www.lacework.com/blog-attacks-exploiting-confluence/; classtype:misc-attack; sid:2027367; rev:5; metadata:affected_product Linux, attack_target Client_Endpoint, created_at 2019_05_19, deployment Perimeter, deprecation_reason Relevance, performance_impact Low, signature_severity Minor, updated_at 2023_04_28;)