alert tcp $EXTERNAL_NET 80 -> $HOME_NET any (msg:"ET MALWARE Prg Trojan Server Reply"; flow:to_client,established; content:"HTTP"; depth:4; content:"|0d0a|Hall|3a|"; depth:512; reference:url,www.securescience.net/FILES/securescience/10378/pubMalwareCaseStudy.pdf; classtype:trojan-activity; sid:2003183; rev:5; metadata:created_at 2010_07_30, signature_severity Major, updated_at 2019_07_26;)