alert udp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Suspected PlugX Checkin Activity (udp)"; dsize:24; content:"|30 00|"; startswith; content:"|00 00 00 bf 68|"; distance:1; within:5; content:"|00 04 00 00 00 10 00 00 00 00 00 00|"; distance:4; within:12; fast_pattern; threshold:type limit, count 1, seconds 20, track by_src; reference:md5,3db876a7ab11ce98687d381ec9207256; reference:md5,98b2faafb027cc4c225d9de1616f430c; reference:url,twitter.com/0xrb/status/1496747426505531398; classtype:trojan-activity; sid:2035308; rev:3; metadata:attack_target Client_Endpoint, created_at 2022_02_28, deployment Perimeter, malware_family PlugX, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2023_03_20;)