alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE MSIL/Revenge-RAT Keep-Alive Activity (Outbound) M2"; flow:established,to_server; dsize:<50; content:"keepAlivePing"; startswith; content:"|40 23 25 5e 4e 59 41 4e 23 21 40 24|"; fast_pattern; endswith; reference:md5,2d03cfb7357ab919e35546adc9db167a; reference:md5,c25b797d6737751936766cd50e26d725; reference:url,twitter.com/Srujank48668412/status/1509520095068192780; classtype:command-and-control; sid:2035885; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2020_02_19, deployment Perimeter, malware_family Revenge_RAT, confidence High, signature_severity Major, updated_at 2020_02_19;)