alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"BACKDOOR [PTsecurity] SSVagent.APT31"; flow:established, to_server; content:"|00 00 00 01 00 00 00 01 00 00 00|"; offset:1; depth:11; http_client_body; pcre:"/^[A-F-0-9]{32}/RP"; reference:url, github.com/ptresearch/AttackDetection; metadata:created_at 2021_05_13, updated_at 2021_05_14; classtype:trojan-activity; sid:10006530; rev:1;)