alert tcp any any -> any any (msg:"TOOLS [PTsecurity] AdaptixC2 Response"; flow:established, to_client; dsize:17; stream_size:server, <=, 18; content:"AdaptixC2|20|server|0a|"; startswith; reference:url, github.com/Adaptix-Framework/AdaptixC2; reference:url, www.virustotal.com/gui/file/4df6ecd60bc6b583277ba77b45767c446e1723e2b4e77b31ddc885e276d23610/detection; reference:url, rules.ptsecurity.com; classtype:attempted-admin; sid:10016592; rev:1;)