alert udp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/MataDoor CnC Beacon Over UDP"; content:"|00 04 00 00 00 00 00 00 00 00 01|"; startswith; fast_pattern; dsize:15; threshold:type limit, seconds 300, count 1, track by_src; reference:md5,34e3e94f9955c101640b44926bc44393; reference:url,ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/dark-river-you-can-t-see-them-but-they-re-there/; classtype:trojan-activity; sid:2048550; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2023_10_12, deployment SSLDecrypt, malware_family Win32_MataDoor, confidence High, signature_severity Critical, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2023_10_12;)