alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Alina Server Response Code"; flow:established,from_server; http.response_line; content:"|20|666 OK"; fast_pattern; endswith; reference:url,blog.spiderlabs.com/2013/05/alina-shedding-some-light-on-this-malware-family.html; reference:md5,7d6ec042a38d108899c8985ed7417e4a; classtype:trojan-activity; sid:2016991; rev:7; metadata:created_at 2013_06_08, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_11_05;)