alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE MACE C2 Framework Response M2"; flow:established,to_client; flowbits:isset,ET.maceframework; http.stat_code; content:"200"; http.server; content:"BaseHTTP"; startswith; fast_pattern; content:"Python/"; distance:0; http.header; content:!"Content-Length"; file.data; pcre:"/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$/"; reference:url,github.com/nickvangilder/most-average-c2-ever/; classtype:trojan-activity; sid:2049131; rev:1; metadata:attack_target Client_Endpoint, created_at 2023_11_09, deployment Perimeter, deployment SSLDecrypt, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2023_11_09; target:dest_ip;)