alert http1 $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Pushdo.S CnC response"; flow:established,to_client; flowbits:isset,ET.Pushdo.S; http.header_names; content:"|0d 0a|X-GeoIP-Country-Code|0d 0a|"; fast_pattern; content:"|0d 0a|X-Real-IP|0d 0a|"; reference:md5,27aef1d328da442d3bd02c50c1a6b651; classtype:command-and-control; sid:2018897; rev:7; metadata:created_at 2014_08_06, former_category RETIRED, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2025_01_03;)