alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Havex RAT CnC Server Response HTML Tag"; flow:established,from_server; http.header; content:!"Keep-Alive|3a 20|"; nocase; content:!"Conncection|3a 20|Keep-Alive"; nocase; file_data; content:"|3c|mega http|2d|equiv|3d|"; fast_pattern; content:"|3c 2f|head|3e 3c|body|3e|"; within:200; reference:md5,6557d6518c3f6bcb8b1b2de77165c962; classtype:command-and-control; sid:2018244; rev:5; metadata:created_at 2014_03_11, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2022_04_08, reviewed_at 2024_02_16;)