alert tcp $EXTERNAL_NET !5665 -> $HOME_NET any (msg:"ET MALWARE Possible Netwire RAT Client HeartBeat C2"; flow:established,to_client; flowbits:isset,ET.Netwire.HB; dsize:5; content:"|01 00 00 00|"; depth:4; pcre:"/^[\x01-\x4c]$/R"; threshold:type threshold, track by_src, count 3, seconds 60; reference:md5,154a2366cd3e39e8625f5f737f9da8f1; reference:md5,e01c79d227c6315150f7ff0afe40db4c; classtype:command-and-control; sid:2018283; rev:8; metadata:created_at 2014_03_14, confidence Medium, signature_severity Major, updated_at 2021_10_08;)