alert dns any any -> any 53 (msg:"SUSPICIOUS [PTsecurity] Possible DecoyDog DNS Tunneling"; flow:to_server; dsize:>80; content:"|00 01 00 00 00 00 00 00 08|"; offset:4; depth:9; content:"|20|"; distance:8; within:1; content:"|18|"; distance:32; within:1; pcre:"/^.{10}\x08[a-z0-9]{8}\x20[a-z0-9]{32}\x18[a-z0-9]{24}/"; threshold:type threshold, track by_dst, count 2, seconds 125; reference:url, https://insights.infoblox.com/resources-whitepaper/infoblox-whitepaper-decoy-dog-is-no-ordinary-pupy-distinguishing-malware-via-dns; reference:url, rules.ptsecurity.com; classtype:misc-activity; sid:10010052; rev:1;)