alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Win32/Neutrino Bot Fake 404 Checkin Response"; flow:established,to_client; http.stat_code; content:"404"; file.data; content:"<!--"; distance:0; content:"NCMD|3a|"; within:6; reference:url,blog.fortinet.com/post/hiding-malicious-traffic-under-the-http-404-error; classtype:command-and-control; sid:2020949; rev:5; metadata:created_at 2015_04_20, malware_family Win32_Neutrino, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_06;)