alert tcp any any -> any any (msg:"TOOLS [PTsecurity] Croc file transfer tool activity"; flow:established, to_server; content:"croc"; depth:4; content:!"|00|"; within:1; content:"|00 00|"; distance:2; within:2; threshold:type both, track by_src, count 10, seconds 120; reference:url, github.com/schollz/croc; reference:url, rules.ptsecurity.com; classtype:attempted-admin; sid:10011012; rev:1;)