alert tcp any any -> $EXTERNAL_NET any (msg:"SPYWARE [PTsecurity] SpyNote"; dsize:>19; pcre:"/^[0-9]{1,5}\x00[0-9]{1,5}\x00/"; content:"|1f 8b 08 00 00 00 00 00|"; distance:0; within:8; content:"|1f 8b 08 00 00 00 00 00|"; distance:1; threshold:type limit, track by_src, count 1, seconds 120; reference:url, https://www.threatfabric.com/blogs/spynote-rat-targeting-financial-institutions.html; reference:url, rules.ptsecurity.com; classtype:trojan-activity; sid:10008415; rev:1;)