alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER AnonGhost PHP Webshell"; flow:established,to_client; file.data; content:"base64_decode("; content:"Bbm9uR2hvc3Qg"; fast_pattern; classtype:trojan-activity; sid:2023143; rev:3; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2016_09_01, deployment Datacenter, performance_impact Low, signature_severity Major, updated_at 2024_03_14;)