alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Win32/Neutrino Bot Fake 404 Checkin Response"; flow:to_client,established; http.stat_code; content:"404"; file.data; content:"<!--"; distance:0; content:"NCMD|3a|"; within:6; reference:url,blog.fortinet.com/post/hiding-malicious-traffic-under-the-http-404-error; classtype:command-and-control; sid:2020949; rev:4; metadata:created_at 2015_04_20, malware_family Win32_Neutrino, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_08_04;)