alert tcp $HOME_NET any -> $EXTERNAL_NET !$HTTP_PORTS (msg:"ET ADWARE_PUP [PTsecurity] DeathBot.Java (Minecraft Spambot)"; flow:established, to_server; dsize:<256; content:"|00 00 00|"; depth:3; content:"|01 78 9c|"; distance:1; within:3; fast_pattern; byte_jump:1,3,from_beginning,post_offset 2; isdataat:1, relative; isdataat:!2,relative; threshold:type limit, track by_src, count 1, seconds 30; classtype:pup-activity; sid:2024793; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2017_10_02, deployment Perimeter, malware_family Spambot, performance_impact Moderate, confidence High, signature_severity Minor, updated_at 2020_08_19;)