alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ADWARE_PUP Win32/RiskWare.YouXun.X CnC Server Response"; flow:established,to_client; http.stat_code; content:"200"; http.header.raw; content:"Server|3a 20 20 20 20 20 20|"; startswith; content:"|20 20 20 20 20 20 20 20|/SERVER IP|3a 20 20 20|SERverWanip|0d 0a|"; within:60; fast_pattern; reference:md5,67d0bacdb3eae462fd5121eeb72e498f; classtype:command-and-control; sid:2029532; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2020_02_25, deployment Perimeter, performance_impact Low, confidence Medium, signature_severity Major, updated_at 2020_02_25;)