alert http any any -> $HOME_NET any (msg:"ET MALWARE Possible Tunna Proxy Closing Connection"; flow:established,from_server; http.stat_code; content:"200"; file.data; content:"|5b|Server|5d 20|Closing|20|the|20|connection|20|"; startswith; fast_pattern; reference:url,github.com/SECFORCE/Tunna; classtype:trojan-activity; sid:2028583; rev:2; metadata:created_at 2019_09_13, deployment Perimeter, malware_family Tunna, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_09_02;)