alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET HUNTING Observed Nighthawk 404 Server Response"; flow:established,to_client; http.stat_code; content:"404"; http.header; content:"X-Test|3a 20|2|0d 0a|"; fast_pattern; file.data; content:"Nothing to see here."; reference:url,twitter.com/1ZRR4H/status/1600569404705619988; reference:url,twitter.com/1ZRR4H/status/1615791320982818830; classtype:bad-unknown; sid:2043331; rev:1; metadata:attack_target Client_Endpoint, created_at 2023_01_18, deployment Perimeter, deployment SSLDecrypt, confidence Medium, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2023_01_18; target:src_ip;)