alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Possible Cobalt Strike Server Response"; flow:established,to_client; http.stat_code; content:"200"; http.server; content:"ESF"; bsize:3; fast_pattern; http.content_len; byte_test:0,=,0,0,string,dec; reference:md5,5b5a730628dc9eba2c12530d225c2f70; classtype:command-and-control; sid:2032974; rev:2; metadata:attack_target Client_Endpoint, created_at 2021_05_18, deployment Perimeter, deprecation_reason False_Positive, malware_family Cobalt_Strike, performance_impact Low, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2021_05_20;)