alert tcp any any -> any any (msg:"REMOTE [PTsecurity] Gh0st"; flow:established, to_server; dsize:200<>400; stream_size:server, <, 3; content:"|a1 a6 a0|"; depth:3; content:"|8f 90 90 ac 92 90 90 bf 84 90 90 e8 0c a9 4f d0|"; distance:1; within:16; reference:url, https://tria.ge/240402-bd4hzaca7x/behavioral2; reference:url, rules.ptsecurity.com; classtype:trojan-activity; sid:10011296; rev:2;)