alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Win32/ProcessKiller CnC - Server Side"; flow:established,to_client; flowbits:isset,ET.ProcessKiller.Client; content:"|00 00|"; offset:2; content:"|c1 01 00 00 00 00 ca 00|"; distance:2; within:10; fast_pattern; byte_jump:2,0, little, from_beginning, post_offset -1; isdataat:!2,relative; threshold:type limit, seconds 120, count 1, track by_dst; reference:md5,1bea43ae6680c0925e6ac5909888a6d4; classtype:trojan-activity; sid:2052264; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, affected_product Windows_11, attack_target Client_Endpoint, tls_state plaintext, created_at 2024_04_24, deployment Perimeter, malware_family ProcessKiller, performance_impact Low, confidence High, signature_severity Major, updated_at 2024_04_24; target:dest_ip;)