alert dns any any -> any any (msg:"🐾 - ☠ DNS request 🌐 - 🎛 C2 🐀 GravityRAT"; flow:to_server, stateless; dns_query; content:"windowsupdates.eu"; nocase; reference:url,https://securelist.com/gravityrat-the-spy-returns/99097/; reference:url,https://malpedia.caad.fkie.fraunhofer.de/details/win.gravity_rat; metadata:created_at 2020_10_23, updated_at 2020_10_23; sid:3309813; rev:1; classtype:trojan-activity;)