alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Smoke Loader C2 Response"; flow:established,to_client; http.content_len; bsize:1; content:"4"; file.data; content:"Smk"; startswith; fast_pattern; pcre:"/^\d+[\r\n]*?$/Rs"; classtype:command-and-control; sid:2015835; rev:8; metadata:created_at 2012_10_23, signature_severity Major, updated_at 2024_02_23;)