ET HUNTING Suspicious Domain Request for Possible COVID-19 Domain M2

alert dns $HOME_NET any -> any any (
    msg:"ET HUNTING Suspicious Domain Request for Possible COVID-19 Domain M2";
    dns.query;
    content:"corona"; nocase;
    content:!".jhu.edu";
    isdataat:!1,relative;
    content:!".ncsc.gov.ie";
    isdataat:!1,relative;
    content:!".nhs.wales";
    isdataat:!1,relative;
    content:!".govt.nz";
    isdataat:!1,relative;
    content:!".nhp.gov.in";
    isdataat:!1,relative;
    content:!".oracle.com";
    isdataat:!1,relative;
    content:!".cdc.gov";
    isdataat:!1,relative;
    content:!"covid19.wisc.edu";
    isdataat:!1,relative;
    content:!"services.corona.be";
    isdataat:!1,relative;
    content:!".coronawarn.app";
    isdataat:!1,relative;
    classtype:bad-unknown;
    sid:2029710; rev:6;
    metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2020_03_23, deployment Perimeter, confidence Medium, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2022_12_13;
)