alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET RETIRED Earth Lusca/SprySOCKS CnC Checkin"; flow:established,to_server; content:"|bc bc ac ac|"; fast_pattern; offset:4; depth:4; byte_jump:4,0,relative, post_offset -1; isdataat:!2,relative; reference:url,www.trendmicro.com/en_us/research/23/i/earth-lusca-employs-new-linux-backdoor.html; classtype:trojan-activity; sid:2048118; rev:3; metadata:affected_product Linux, attack_target Client_and_Server, created_at 2023_09_19, deployment Perimeter, former_category MALWARE, malware_family SprySOCKS, performance_impact Moderate, confidence Medium, signature_severity Major, updated_at 2025_04_17, reviewed_at 2025_04_17; target:src_ip;)