alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Anuna PHP Backdoor Sucessful Exploit"; flow:established,from_server; flowbits:isset,ET.Anuna.Backdoor; http.stat_code; content:"200"; file.data; content:"cookie=4"; within:8; classtype:trojan-activity; sid:2023306; rev:3; metadata:affected_product PHP, attack_target Web_Server, created_at 2016_09_28, deployment Perimeter, malware_family Anuna, signature_severity Major, updated_at 2020_07_29;)