alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Pupy RAT Default TLS Proxy Certificate"; flow:established,to_client; tls.cert_issuer; content:"O=Pupy CA"; fast_pattern; content:"C=ZZ"; reference:url,github.com/n1nj4sec/pupy/blob/a5d766ea81fdfe3bc2c38c9bdaf10e9b75af3b39/services/proxy/generate.go#L97; classtype:command-and-control; sid:2046948; rev:1; metadata:attack_target Client_and_Server, created_at 2023_07_27, deployment Perimeter, malware_family PupyRat, performance_impact Low, confidence High, signature_severity Critical, updated_at 2023_07_27; target:dest_ip;)