alert tcp any any -> any any (msg:"REMOTE [PTsecurity] Ryuk Client Heartbeat"; flow:established, to_server; dsize:29; stream_size:client, =, 30; stream_size:server, <, 3; content:"|44 4b 00 00 29 af a3 d2 11 00 00 00 08 0a 11 45|"; depth:16; reference:url, https://tria.ge/240331-f2rarsfa57/behavioral2; reference:url, rules.ptsecurity.com; classtype:trojan-activity; sid:10011307; rev:2;)