alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE OSX/Mokes.A CnC Heartbeat"; flow:established,to_client; dsize:<300; content:"200"; offset:9; depth:3; content:"Content-Type|3a 20|text/html"; content:"Connection|3a 20|close|0d 0a|"; content:"Content-Encoding|3a 20|gzip|0d 0a|"; flowbits:isset,ET.OSX.Mokes; reference:url,securelist.com/blog/research/75990/the-missing-piece-sophisticated-os-x-backdoor-discovered; classtype:command-and-control; sid:2023183; rev:2; metadata:affected_product Mac_OSX, created_at 2016_09_08, deployment Perimeter, malware_family OSX_Mokes_A, confidence High, signature_severity Major, tag OSX_Malware, updated_at 2019_07_26;)