alert dns $HOME_NET any -> any any (msg:"ET MALWARE DNSBin Demo (requestbin .net) - Data Exfil M1"; threshold:type limit, track by_src, seconds 180, count 1; dns.query; bsize:>32; content:"|2e|"; content:".d.requestbin.net"; distance:20; within:17; endswith; reference:md5,887648a50d31ed3f5f2f7bbe0d7eb35a; reference:url,requestbin.net/dns; classtype:command-and-control; sid:2030876; rev:3; metadata:attack_target Client_Endpoint, created_at 2020_09_14, deployment Perimeter, deprecation_reason Duplicate, performance_impact Low, confidence High, signature_severity Major, updated_at 2022_09_29;)