alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE [PTsecurity] Babylon RAT (Dodiw.A VT) Check-in"; flow:established, to_server, only_stream; content:!"|ff|"; offset:0; depth:1; content:"|ff|"; fast_pattern; offset:1; depth:1; content:!"|ff|"; offset:2; depth:1; content:"|ff|"; offset:3; depth:1; content:!"|ff|"; offset:4; depth:1; pcre:"/^(.\xff.\xff).\xff.\xff\1(?!\1)/"; pcre:"/^(?:.\xff){32}/"; isdataat:!256; classtype:trojan-activity; metadata:created_at 2017_2_2; reference:url, github.com/ptresearch/AttackDetection; sid:11000978; rev:2;)