alert dns any any -> any any (msg:"🐾 - ☠ DNS request 🌐 --> 🎛 C2 🐀 Revenge RAT"; flow:to_server, stateless; dns_query; content:"xxsaaaw.ddns.net"; nocase; reference:url,https://twitter.com/ScumBots/status/1287421834615492610; reference:url,https://malpedia.caad.fkie.fraunhofer.de/details/win.revenge_rat; metadata:created_at 2020_07_26, updated_at 2020_07_26; sid:3312747; rev:1; classtype:trojan-activity;)