alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE [ANY.RUN] Win32/DynamicRAT CnC Activity"; flow:established,to_server; content:"|00 00 00 00 04 01 00|"; depth:7; fast_pattern; content:"|01 00 00 00 02 05 02 01 00|"; distance:1; within:9; content:"|01 00|"; distance:256; within:2; reference:md5,794aad15e92d121225ac8f98f7173658; reference:url,app.any.run/tasks/211d3453-d909-47e4-96d4-c27cfb5398c4; reference:url,community.emergingthreats.net/t/dynamicrat/634; reference:url,gi7w0rm.medium.com/dynamicrat-a-full-fledged-java-rat-1a2dabb11694; classtype:command-and-control; sid:2046187; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2023_06_09, deployment Perimeter, malware_family DynamicRat, confidence High, signature_severity Critical, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2023_06_09;)