alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET POLICY Packity Proxy Connection"; flow:established,to_server; http.start; content:"CONNECT /PROVIDER/PROXY2 HTTP/1.1|0d 0a|Host|3a 20|"; startswith; fast_pattern; content:"|0d 0a|Proxy-Authorization|3a 20|Basic "; distance:0; content:"=|0d 0a|"; distance:119; within:3; reference:md5,9d245ac24d0dad591d01d2ef52da3ead; classtype:bad-unknown; sid:2030800; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2020_08_26, deployment Perimeter, performance_impact Low, confidence High, signature_severity Minor, updated_at 2020_08_26;)