rule Cerberus : rat { meta: description = "Cerberus" author = "Jean-Philippe Teissier / @Jipe_" date = "2013-01-12" filetype = "memory" version = "1.0" strings: $checkin = "Ypmw1Syv023QZD" $clientpong = "wZ2pla" $serverping = "wBmpf3Pb7RJe" $generic = "cerberus" nocase condition: any of them }