alert http any any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Non-Local Burp Proxy Error"; flow:established,to_client; http.stat_code; content:"502"; http.stat_msg; content:"Bad gateway"; file.data; content:"Burp proxy error|3A 20|"; within:18; reference:url,portswigger.net/burp/proxy.html; classtype:successful-admin; sid:2017148; rev:4; metadata:created_at 2013_07_16, signature_severity Minor, updated_at 2020_04_24;)