alert tcp any 666 -> any 4444 (msg:"ET MALWARE Reptile Linux LKM Rootkit Backdoor Activity"; flow:not_established; dsize:<40; content:"hax0r"; fast_pattern; reference:url,github.com/f0rb1dd3n/Reptile; classtype:trojan-activity; sid:2048042; rev:1; metadata:attack_target Linux_Unix, created_at 2023_09_12, deployment Perimeter, performance_impact Low, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2023_09_12, reviewed_at 2023_09_12; target:dest_ip;)