alert tcp $EXTERNAL_NET [19400:19500] -> $HOME_NET any (msg:"ET MALWARE Win32/Spy.Agent.POX Variant CnC"; flow:established,to_client; dsize:4; content:"|6c 69 73 74|"; reference:md5,bb15e442a527a83939d9ff1b835f99dd; classtype:command-and-control; sid:2035057; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_03_22, deployment Perimeter, malware_family Win32_Spy_Agent_POX, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2019_07_26;)