alert dns any any -> any any (msg:"🐾 - ☠ DNS request 🌐 - 🎛 C2 🐀 AsyncRAT"; flow:to_server, stateless; dns_query; content:"ftp.triplelink.co.th"; nocase; reference:url,https://www.joesandbox.com/analysis/252974/0/html; reference:url,https://malpedia.caad.fkie.fraunhofer.de/details/win.hawkeye_keylogger; metadata:created_at 2020_07_29, updated_at 2020_07_29; sid:3309818; rev:1; classtype:trojan-activity;)