alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE rat-test CnC Response"; flow:established,to_client; dsize:8; content:"d|00|o|00|n|00|e|00|"; nocase; flowbits:isset,ET.tcpraw.png; reference:md5,a271e5179f0a98a295736bd7a41a39fc; reference:url,twitter.com/James_inthe_box/status/1501604645759709186; classtype:trojan-activity; sid:2035477; rev:3; metadata:attack_target Client_Endpoint, created_at 2022_03_16, deployment Perimeter, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_09_12, reviewed_at 2024_09_12;)