alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET HUNTING Server Responding to JPG Request with Fake JPG Structure"; flow:established,to_client; flowbits:isset,ET.Outbound.JPG.Req; http.stat_code; content:"200"; http.response_body; content:"|ff d8|"; startswith; content:!"JFIF"; within:50; content:"OOOOOOOO"; fast_pattern; content:"|00 00 00 00 00 00 00|"; within:100; classtype:bad-unknown; sid:2054406; rev:1; metadata:created_at 2024_07_07, performance_impact Moderate, confidence High, signature_severity Minor, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_07_08;)