alert dns $HOME_NET any -> any any (msg:"ET MALWARE Chafer CnC Domain in DNS Lookup"; dns.query; content:"sabre-css.com"; nocase; endswith; reference:url,securityintelligence.com/posts/observations-of-itg07-cyber-operations/; classtype:command-and-control; sid:2027482; rev:3; metadata:created_at 2019_06_17, deployment Perimeter, performance_impact Low, confidence High, signature_severity Major, tag Chafer, tag APT39, updated_at 2020_09_17;)