alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"REMOTE [PTsecurity] PoisonX/10FXRAT Checkin"; flow:established, to_server, only_stream; content:"10FX"; startswith; fast_pattern; content:"|22|isAdmin|22|"; nocase; within:256; content:"|22|hasCamera|22|"; nocase; within:72; reference:url, www.virustotal.com/gui/file/989c7646783861ec191336b0fea55ad49282268f97678f2b77f4406cd2d516ea/detection; reference:url, www.derp.ca/research/poisonx-windowstelemetry-byovd-rat/; reference:url, www.lac.co.jp/lacwatch/report/20260604_004759.html; reference:url, rules.ptsecurity.com; classtype:trojan-activity; sid:10017123; rev:1;)