alert http any any -> any any (msg:"SUSPICIOUS [PTsecurity] Possible ClayRAT Checkin"; flow:established, to_server; http.method; content:!"GET"; http.uri; urilen:50; content:"/newclient?id="; startswith; fast_pattern; pcre:"/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/R"; http.header; content:!"Referer|3a|"; nocase; content:"Content-Type|3a| application/x-www-form-urlencoded"; nocase; http.user_agent; content:!"Mozilla"; nocase; startswith; http.request_body; bsize:0; threshold:type limit, track by_dst, count 1, seconds 60; reference:url, tria.ge/250820-1zqaxacp2v/behavioral3; reference:url, rules.ptsecurity.com; classtype:misc-activity; sid:10014561; rev:3;)