alert tcp-pkt any any -> any any (msg:"ET MALWARE EARTHWORM SOCKS Reverse Proxy Initial Setup Request"; flow:established,to_server; flowbits:set,ET.earthworm.setup.stage1; flowbits:noalert; dsize:6; content:"|01 01|"; fast_pattern; startswith; reference:url,community.emergingthreats.net/t/sig-earthworm-reverse-socks-handshake-and-tunnel-sequence-detection/3314; classtype:trojan-activity; sid:2069302; rev:1; metadata:affected_product Any, attack_target Client_and_Server, tls_state plaintext, created_at 2026_05_14, deployment Perimeter, deployment Internal, malware_family EarthWorm, performance_impact Significant, confidence High, signature_severity Major, tag SOCKS_Reverse_Proxy, updated_at 2026_05_14, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1090, mitre_technique_name Proxy;)