alert tcp $HOME_NET any -> $EXTERNAL_NET [!80,!443,!445] (msg:"ET MALWARE Win32/Orchard Botnet Activity M2"; flow:established,to_server; content:"|7b 22|Identity|22 3a 22|"; content:"|22 2c 22|Architecture|22 3a|"; distance:0; content:"|2c 22|Antivirus|22 3a 5b|"; distance:1; content:"|2c 22|DotNetStatus|22 3a|"; distance:0; content:"|2c 22|Bot_Version|22 3a 22|"; fast_pattern; distance:0; reference:url,blog.netlab.360.com/orchard-dga/; reference:md5,f3e0b960a48b433bc4bfe6ac44183b74; classtype:trojan-activity; sid:2038706; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_09_01, deployment Perimeter, malware_family Win32_Orchard, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2022_09_01;)