alert tcp any any -> $EXTERNAL_NET any (msg:"WORM [PTsecurity] Expiro"; flow:established, to_server; stream_size:client, <, 80; stream_size:client, >, 50; stream_size:server, <, 3; content:"|17 00 00 00 af b0 f3 aa f1 98 b0 ff|"; depth:12; reference:url, https://tria.ge/240229-lbqt7scg95/behavioral1; reference:url, rules.ptsecurity.com; classtype:trojan-activity; sid:10011031; rev:1;)