alert dns any any -> $HOME_NET any (msg:"ET MALWARE Linux/B1txor20 Backdoor DNS Tunnel Activity M1"; byte_test:1,&,128,3; content:"|00 00 10 00 01 c0 0c 00 10 00 01 00 00 00 01|"; content:"1"; distance:3; within:1; content:"E6NZwc"; distance:2; within:6; fast_pattern; reference:url,blog.netlab.360.com/b1txor20-use-of-dns-tunneling_en/; reference:md5,43fcb5f22a53a88e726ebef46095cd6b; classtype:command-and-control; sid:2035527; rev:2; metadata:affected_product Linux, attack_target Client_Endpoint, created_at 2022_03_18, deployment Perimeter, deployment Internal, malware_family B1txor20, performance_impact Low, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2022_03_18;)