alert dns $HOME_NET any -> any any (msg:"ET MALWARE Possible SombRAT Initial DNS Lookup"; dns.query; content:!".amazonaws.com"; content:!".cooperhewitt.org"; content:!".sagaftra.org"; content:!".a2zinc.net"; content:!".zalando-lounge.ch"; content:!".sipri.org"; content:!".y-cloud.net"; content:"images"; nocase; depth:6; fast_pattern; content:!"images."; depth:7; content:"."; distance:8; within:1; pcre:"/^images[a-f0-9]{8}\./i"; reference:md5,f43377b04b66d1aed783cd6037e3298d; reference:url,blogs.blackberry.com/en/2020/11/the-costaricto-campaign-cyber-espionage-outsourced; classtype:trojan-activity; sid:2031251; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2020_12_03, deployment Perimeter, performance_impact Moderate, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2022_09_22;)