alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Linux.DDoS Checkin"; flow:established,to_server; dsize:1024; content:"VERSONEX|3a|"; depth:9; content:"|7c|Hacker|00 00 00|"; distance:0; reference:md5,0eab12cebbf1c8f25d82c65f34aab9d7; classtype:command-and-control; sid:2019172; rev:4; metadata:created_at 2014_08_19, signature_severity Major, updated_at 2019_07_26;)