alert udp $HOME_NET any -> any 53 (msg:"BLACKLIST DNS request for known malware domain counter.yadro.ru"; flow:to_server; byte_test:1,!&,0xF8,2; content:"|07|counter|05|yadro|02|ru|00|"; fast_pattern:only; metadata:impact_flag red, service dns; refer...