alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Ceckno Reporting to Controller"; flow:established,to_server; dsize:<30; content:"\:2|7c|"; depth:10; content:"|7c|"; distance:0; content:"|7c|"; distance:0; pcre:"/^\d+\x3a\d\x7c\d+\x7c[0-9a-z]+\x7c\d/i"; flowbits:set,ET.cekno.initial; classtype:trojan-activity; sid:2008177; rev:5; metadata:created_at 2010_07_30, signature_severity Major, updated_at 2019_07_26;)