alert dns $HOME_NET any -> any any (msg:"ET MALWARE Suspected Agent Racoon Backdoor DNS Related Activity"; dns.query; content:"xn--"; startswith; content:".xn--"; distance:5; within:25; content:".a."; distance:3; within:10; fast_pattern; pcre:"/^[0-9-a-z]{4}/R"; content:".telemetry."; within:11; reference:url,unit42.paloaltonetworks.com/new-toolset-targets-middle-east-africa-usa/; reference:md5,afd57b72f75da18929be87c0df5c8a5a; reference:md5,231867ad872656f37938d23002f8e9e3; classtype:trojan-activity; sid:2051699; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, affected_product Windows_11, attack_target Client_Endpoint, tls_state plaintext, created_at 2024_03_20, deployment Perimeter, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_20; target:src_ip;)