alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Hupigon.dkxh Checkin to CnC"; flow:established,to_server; content:"OK|2e 01|200"; fast_pattern; depth:20; offset:13; content:"Windows "; distance:4; within:30; classtype:command-and-control; sid:2008540; rev:4; metadata:created_at 2010_07_30, signature_severity Major, updated_at 2019_07_26;)