alert udp $HOME_NET any -> any 53 (msg:"ETPRO TROJAN DNS Query to Cerber Domain (google . com) old style"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|google|03|com|00|"; fast_pattern; distance:0; nocase; classtype:trojan-activity; sid:3030; rev:1;)

alert udp $HOME_NET any -> any 53 (msg:"ETPRO TROJAN DNS Query to Cerber Domain (google . com) modified old style"; content:"|01|"; offset:2; depth:1; content:"|00 01 00 00 00 00 00|"; distance:1; within:7; content:"|06|google|03|com|00|"; fast_pattern; distance:0; nocase; classtype:trojan-activity; sid:3031; rev:1;)

alert udp $HOME_NET any -> any 53 (msg:"ETPRO TROJAN DNS Query to Cerber Domain (google . com) bytes only"; content:"|06|google|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:3032; rev:1;)

alert dns $HOME_NET any -> any any (msg:"ETPRO TROJAN DNS Query to Cerber Domain (google . com) dns_query only"; dns_query; content:"google.com"; isdataat:!1,relative; classtype:trojan-activity; sid:30311; rev:1;)

alert dns $HOME_NET any -> any any (msg:"ETPRO TROJAN DNS Query to Cerber Domain (google . com) dns_query and content match"; content:"|06|google|03|com|00|"; fast_pattern; nocase; dns_query; content:"google.com"; isdataat:!1,relative; classtype:trojan-activity; sid:30312; rev:1;)

# Snort 2.9.x
   Num      SID GID Rev     Checks   Matches    Alerts           Microsecs  Avg/Check  Avg/Match Avg/Nonmatch   Disabled
     1     3031   1   1       1293      1293      1293                1831        1.4        1.4          0.0          0
     2     3030   1   1       1293        86        86                1654        1.3        2.8          1.2          0
     3     3032   1   1       1293      1293      1293                 609        0.5        0.5          0.0          0

# 2.0.4
   Num      Rule         Gid      Rev      Ticks        %      Checks   Matches  Max Ticks   Avg Ticks   Avg Match   Avg No Match
  -------- ------------ -------- -------- ------------ ------ -------- -------- ----------- ----------- ----------- --------------
  1        30311        1        1        9456788      22.87  1291     1291     44732       7325.16     7325.16     0.00
  2        3031         1        1        7921088      19.15  1291     1291     85945       6135.62     6135.62     0.00
  3        3030         1        1        7527863      18.20  1291     84       105572      5831.03     9449.62     5579.20
  4        30312        1        1        13172067     31.85  2674     1291     81352       4925.98     5162.26     4705.41
  5        3032         1        1        3275871      7.92   1291     1291     97849       2537.47     2537.47     0.00


# 4.0.0
  --------------------------------------------------------------------------
  Date: 9/27/2017 -- 15:49:09. Sorted by: average ticks.
  --------------------------------------------------------------------------
   Num      Rule         Gid      Rev      Ticks        %      Checks   Matches  Max Ticks   Avg Ticks   Avg Match   Avg No Match
  -------- ------------ -------- -------- ------------ ------ -------- -------- ----------- ----------- ----------- --------------
  1        30311        1        1        7465374      19.34  1293     1293     116459      5773.68     5773.68     0.00
  2        30312        1        1        10831127     28.06  2679     2676     3030646     4042.97     4047.03     429.00
  3        3030         1        1        8859523      22.96  2679     84       13021       3307.03     9017.77     3122.17
  4        3031         1        1        8009804      20.75  2679     1291     9107        2989.85     5711.41     458.48
  5        3032         1        1        3427696      8.88   2679     1291     6929        1279.47     2244.46     381.91