alert dns any any -> any any (msg:"🐾 - ☠ DNS request 🌐 - 🎛 TerraLoader C2"; flow:to_server, stateless; dns_query; content:"maps.doaglas.com"; nocase; reference:url,https://twitter.com/VK_Intel/status/1286747453849468929; reference:url,https://malpedia.caad.fkie.fraunhofer.de/details/win.terra_loader; metadata:created_at 2020_07_25, updated_at 2020_07_25; sid:3315812; rev:1; classtype:trojan-activity;)