alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"BOTNET [PTsecurity] AESDDoS/Dofloo"; flow:established, to_server; dsize:20; content:"|49 4e 46 4f 3a 30 2e 30 25 7c 30 2e 30|"; depth:13; content:"|20 4d 62 70 73 00|"; distance:1; within:6; reference:url, https://cape.contextis.com/analysis/39282/; reference:url, rules.ptsecurity.com; classtype:trojan-activity; sid:10004701; rev:6;)