alert tcp any any -> any any (msg:"ET MALWARE DPRK HIDDEN COBRA DDoS Handshake Success"; dsize:6; flow:established,to_server; content:"|18 17 e9 e9 e9 e9|"; fast_pattern; reference:url,www.us-cert.gov/ncas/alerts/TA17-164A; classtype:trojan-activity; sid:2024382; rev:3; metadata:attack_target Client_Endpoint, created_at 2017_06_14, deployment Perimeter, confidence Medium, signature_severity Major, updated_at 2020_08_19;)