alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"REMOTE [PTsecurity] XWorm Ping"; flow:established, to_server; dsize:19; content:"16|00 53 9c 47 5c 59 25 30 ab 7d 21 76 83 fa 5e 04 9e|"; depth:19; threshold:type limit, track by_dst, seconds 120, count 1; reference:md5, ed22b81e3a57a1622dd8a8900411e520; reference:url, github.com/Shinyenigma/XWorm-RAT/; reference:url, rules.ptsecurity.com; classtype:trojan-activity; sid:10008313; rev:3;)