ET MALWARE DeimosC2 TCP Agent Heartbeat

alert tcp-pkt $HOME_NET any -> any any (
    msg:"ET MALWARE DeimosC2 TCP Agent Heartbeat";
    flow:established,to_server;
    dsize:296;
    content:"|00 00 00 00 00 00 01 20|"; startswith; fast_pattern;
    content:!"|fe 53 4d 42 40|"; within:5;
    threshold:type both, count 2, seconds 60, track by_src;
    reference:url,www.trendmicro.com/en_us/research/22/k/deimosc2-what-soc-analysts-and-incident-responders-need-to-know.html;
    classtype:trojan-activity;
    sid:2039764; rev:2;
    metadata:attack_target Client_and_Server, created_at 2022_11_09, deployment Perimeter, deployment Internal, deployment Datacenter, performance_impact Moderate, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2023_01_31;
)