alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Possible BeEF HTTP Headers Inbound"; flow:established,to_client; http.header; strip_pseudo_headers; header_lowercase; content:"content-type|3a 20|text|2f|javascript|0d 0a|server|3a 20|Apache|2f|2|2e|2|2e|3|20 28|CentOS|29 0d 0a|pragma|3a|"; fast_pattern; startswith; content:"|0d 0a|expires|3a 20|0|0d 0a|"; http.header_names; to_lowercase; content:!"set-cookie|0d 0a|"; content:!"x-powered-by|0d 0a|"; classtype:attempted-user; sid:2024421; rev:7; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2017_06_23, deployment Perimeter, performance_impact Moderate, confidence Medium, signature_severity Major, updated_at 2024_05_02;)