alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE TA577 Style Response (2023-05-15)"; flow:established,to_client; flowbits:isset,ET.TA557.20230515.Request; http.stat_code; content:"200"; http.header; content:"content-description"; nocase; content:"|3a 20|File Transfer|0d 0a|"; within:17; fast_pattern; content:"content-disposition|3a 20|"; nocase; content:"attachment|3b 20|filename|3d|"; within:21; content:"cache-control|3a 20|"; nocase; content:"must|2d|revalidate|2c 20|post|2d|check|3d|0|2c 20|pre|2d|check|3d|0"; within:42; content:"content-transfer-encoding|3a 20|"; nocase; content:"binary|0d 0a|"; within:8; content:"expires|3a 20|0|0d 0a|"; nocase; http.content_type; bsize:24; content:"application/octet-stream"; classtype:trojan-activity; sid:2048222; rev:1; metadata:attack_target Client_and_Server, created_at 2023_09_25, deployment Perimeter, deployment SSLDecrypt, performance_impact Moderate, confidence High, signature_severity Major, tag TA577, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2023_09_25, reviewed_at 2023_09_25; target:dest_ip;)