alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE PcClient Backdoor Checkin"; flow:established,to_server; flowbits:isset,ET.PcClient; flowbits:noalert; dsize:248; content:"|52 0d 12 12|"; depth:4; classtype:command-and-control; sid:2009239; rev:4; metadata:created_at 2010_07_30, signature_severity Major, updated_at 2024_03_15;)