alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE PcClient Backdoor Checkin"; flowbits:isset,ET.PcClient; flow:established,to_server; dsize:248; content:"|52 0d 12 12|"; depth:4; flowbits:noalert; classtype:command-and-control; sid:2009239; rev:2; metadata:created_at 2010_07_30, signature_severity Major, updated_at 2019_07_26;)