rules-botnet

Is there anyone who wrote a complex rules about botnet attack? if it happened may i know or see that rule?