alert dns $HOME_NET any -> any any (msg:"MalSilo MALWARE (nanobot) DNS Lookup"; dns_query; content:"mark1234.duckdns.org"; nocase; depth:20; isdataat:!1,relative; fast_pattern; reference:url,malsilo.gitlab.io/feeds/dumps/master-feed.json; classtype:trojan-activity; sid:5000001; rev:1; metadata:tag peexe32, tag pegui, tag assembly, created_at 2022_12_01, malware_family nanobot, updated_at 2022_12_01;)