alert tls any any -> any any (msg:"REMOTE [PTsecurity] PupyRAT SSL Cert"; flow:established, to_server; content:"|3082|"; depth:300; content:"|0a|QzBYAtJneh"; depth:3000; content:"|0a|juUPvsXSbC"; content:"|06|CLIENT"; distance:1; reference:url, https://github.com/n1nj4sec/pupy; reference:url, rules.ptsecurity.com; classtype:trojan-activity; sid:10011351; rev:1;)