alert tcp any any -> any 445 (msg:"CheekyChipmunk_default_timeout_command";\
	content:"|fe|SMB"; offset:4; depth:4;\
	# Command: IOCTL
	byte_test:2,=,11,8,relative,little;\
	content:"|e0 2e 00 00|"; fast_pattern; offset:148; depth:4;\
	sid:1001410000; rev:1; classtype:malware-cnc;\
	metadata:date 2022-01-24;)
alert tcp any any -> any 445 (msg:"CheekyChipmunk_RPC_GUID";\
	content:"|fe|SMB"; offset:4; depth:4;\
	# Command: Write Request
	byte_test:2,=,9,8,relative,little;\
	content:"d%|f0|}|1e c3|hJ|a6 88|r|d0 ec 84 07|F"; offset:148; depth:16;\
	sid:1001410001; rev:1; classtype:malware-cnc;\
	metadata:date 2022-01-24;)
alert tcp any any -> any 445 (msg:"CheekyChipmunk_namedpipe_pnrsvc";\
	content:"|fe|SMB"; offset:4; depth:4;\
	# Command: Create Request
	byte_test:2,=,5,8,relative,little;\
	content:"p|00|n|00|r|00|s|00|v|00|c|00|"; offset:124; depth:12;\
	sid:1001410002; rev:1; classtype:malware-cnc;\
	metadata:date 2022-01-24;)
alert tcp any any -> any 445 (msg:"CheekyChipmunk_namedpipe_atctl";\
	content:"|fe|SMB"; offset:4; depth:4;\
	# Command: Create Request
	byte_test:2,=,5,8,relative,little;\
	content:"a|00|t|00|c|00|t|00|l|00|"; offset:124; depth:10;\
	sid:1001410003; rev:1; classtype:malware-cnc;\
	metadata:date 2022-01-24;)
alert tcp any any -> any 445 (msg:"CheekyChipmunk_namedpipe_msbrws";\
	content:"|fe|SMB"; offset:4; depth:4;\
	# Command: Create Request
	byte_test:2,=,5,8,relative,little;\
	content:"m|00|s|00|b|00|r|00|w|00|s|00|"; offset:124; depth:12;\
	sid:1001410004; rev:1; classtype:malware-cnc;\
	metadata:date 2022-01-24;)