alert tcp-pkt $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Remcos 3.x Unencrypted Server Response"; flow:established,to_client; content:"|24 04 ff 00|"; startswith; content:"|01 00 00 00 30 7c 1e 1e 1f 7c|"; distance:4; within:10; fast_pattern; threshold:type limit, track by_src, count 1, seconds 120; reference:md5,d27f70216d11b769c937a961fc1b1c81; classtype:command-and-control; sid:2032777; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2021_04_16, deployment Perimeter, malware_family Remcos, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2021_04_16;)