alert tls any any -> any any (msg:"REMOTE [PTsecurity] VenomRAT SSL certificate"; flow:established,from_server; content:"|3082|"; depth:300; content:"|550403|"; depth:600; content:"|08|VenomRAT"; distance:1; within:10; reference:url, rules.ptsecurity.com; classtype:trojan-activity; sid:10010904; rev:1;)