alert http any any -> $HOME_NET any (msg:"ET MALWARE HATVIBE C2 Response"; flow:established,to_client; flowbits:isset,ET.HATVIBE.Beacon; http.response_body; content:"|25 25 25 25|"; startswith; reference:url,www.recordedfuture.com/research/russia-aligned-tag-110-targets-tajikistan-with-macro-enabled; classtype:trojan-activity; sid:2062599; rev:1; metadata:created_at 2025_05_27, signature_severity Unknown, updated_at 2025_05_27;)