alert tcp-pkt any any -> any any (msg:"ET MALWARE EARTHWORM SOCKS Proxy Tunnel Response"; flow:established,to_client; flowbits:isset,ET.earthworm.request.stage1; flowbits:set,ET.earthworm.request.stage2; flowbits:noalert; dsize:6; content:"|01 05|"; fast_pattern; startswith; reference:url,community.emergingthreats.net/t/sig-earthworm-reverse-socks-handshake-and-tunnel-sequence-detection/3314; classtype:trojan-activity; sid:2069306; rev:1; metadata:affected_product Any, attack_target Client_and_Server, tls_state plaintext, created_at 2026_05_14, deployment Perimeter, deployment Internal, malware_family EarthWorm, performance_impact Significant, confidence High, signature_severity Major, tag SOCKS_Reverse_Proxy, updated_at 2026_05_14, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1090, mitre_technique_name Proxy;)