alert tcp-pkt $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity"; flow:established,to_server; dsize:26; content:"|00 00 00 00 15 00 7b 22 54 79 70 65 22 3a 22 41 66 6b 53 79 73 74 65 6d 22 7d|"; fast_pattern; reference:md5,befd0a5f55e4b7ee61490100f71db919; reference:md5,c14742d3e34478e71f9a701392d97967; reference:md5,befd0a5f55e4b7ee61490100f71db919; reference:md5,e366af3563aaa5cb7d8f61b028bb6905; classtype:trojan-activity; sid:2051910; rev:1; metadata:attack_target Client_Endpoint, tls_state plaintext, created_at 2024_04_03, deployment Perimeter, performance_impact Low, confidence High, signature_severity Critical, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_04_03; target:src_ip;)