alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET RETIRED PoisonIvy.2013Jan04 server response"; flow:established,from_server; dsize:48; content:"|48 3A E9 78 C0 B9 2E 3F 9A 49 C5 56 65 5F CE 22|"; offset:16; depth:16; reference:md5,62f20326e0f08c0786df6886f0427ea7; classtype:trojan-activity; sid:2016168; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2013_01_05, deployment Perimeter, former_category MALWARE, malware_family PoisonIvy, confidence Medium, signature_severity Critical, tag PoisonIvy, updated_at 2024_12_05;)