alert http any any -> $HOME_NET any (msg:"ET MALWARE Possible Tunna Proxy Activity (Response)"; flow:established,from_server; http.stat_code; content:"200"; file.data; content:"|5b|Server|5d 20|All|20|good|20|to|20|go"; startswith; fast_pattern; reference:url,github.com/SECFORCE/Tunna; classtype:trojan-activity; sid:2028582; rev:2; metadata:created_at 2019_09_13, deployment Perimeter, malware_family Tunna, performance_impact Low, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_09_02;)