alert udp $HOME_NET any -> $EXTERNAL_NET 40500 (msg:"ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC"; dsize:36; content:"|20 00 00 00|"; fast_pattern; startswith; pcre:"/^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]/R"; threshold:type limit, track by_src, count 5, seconds 30; reference:md5,461f422870426748cc3e24111532472b; classtype:trojan-activity; sid:2044077; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_and_Server, created_at 2023_02_02, deployment Perimeter, malware_family Win32_Phorpiex, performance_impact Low, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2023_02_02;)