alert tls any any -> any any (msg:"REMOTE [PTsecurity] PupyRAT SSL Cert"; flow:established, to_server; content:"|3082|"; depth:300; content:"|0a|CWAHgkJheF"; depth:3000; content:"|0a|YuQLgPyMMN"; content:"|06|CLIENT"; distance:1; reference:url, https://github.com/n1nj4sec/pupy; reference:url, rules.ptsecurity.com; classtype:trojan-activity; sid:10011349; rev:1;)