alert tcp-pkt $HOME_NET any -> any any (msg:"ET MALWARE DeimosC2 TCP Agent Heartbeat"; flow:established,to_server; dsize:296; content:"|00 00 00 00 00 00 01 20|"; startswith; fast_pattern; content:!"|fe 53 4d 42 40|"; within:5; threshold:type both, count 2, seconds 60, track by_src; reference:url,www.trendmicro.com/en_us/research/22/k/deimosc2-what-soc-analysts-and-incident-responders-need-to-know.html; classtype:trojan-activity; sid:2039764; rev:2; metadata:attack_target Client_and_Server, created_at 2022_11_09, deployment Perimeter, deployment Internal, deployment Datacenter, performance_impact Moderate, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2023_01_31;)