alert smb $HOME_NET any -> $HOME_NET 445 (msg:"SPYWARE [PTsecurity] Buhtrap FB set Pegasus.arch_probe"; flow:established, to_server, no_stream; content:"SMB"; content:"|05 00|"; distance:8; within:2; content:"r|00|e|00|g|00|e|00|d|00|i|00|t|00|.|00|e|00|x|00|e|00|"; nocase; distance:96; flowbits:noalert; flowbits:isset, SMB.TreeConnect.ADMIN; flowbits:set, Pegasus.arch_probe; reference:url, rules.ptsecurity.com; classtype:trojan-activity; sid:10003307; rev:4;)