alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"REMOTE [PTsecurity] Orcus"; flow:established,from_server; content:"|3082|"; depth:300; content:"|550403|"; depth:3000; content:"|0c|Orcus Server0"; distance:1; within:14; reference:url, https://app.any.run/tasks/71e6d83c-fd4e-41a9-9c3b-d0a77830a89d; reference:url, rules.ptsecurity.com; classtype:trojan-activity; sid:10006589; rev:3;)