alert http any any -> any any (msg:"REMOTE [PTsecurity] ClayRAT Checkin"; flow:established, to_server; http.method; content:"POST"; http.uri; urilen:50; content:"/newclient?id="; startswith; content:!"&"; fast_pattern; http.header; content:!"Referer|3a|"; nocase; content:"Content-Type|3a| application/octet-stream"; nocase; http.request_body; content:!"|20|"; content:!"|00|"; bsize:>50; threshold:type limit, track by_dst, count 1, seconds 60; reference:url, tria.ge/250820-1zqaxacp2v/behavioral3; reference:url, rules.ptsecurity.com; classtype:trojan-activity; sid:10014562; rev:3;)