alert http1 $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle NYTIMES Server]"; flow:established,to_client; http.response_line; content:"HTTP/1."; startswith; http.header; content:"Accept-Ranges|3a 20|bytes"; content:"Age|3a 20|5806"; content:"Cache-Control|3a 20|public,max-age=31536000"; content:"Content-Encoding|3a 20|gzip"; content:"Content-Length|3a 20|256398"; content:"Content-Type|3a 20|application/javascript"; content:"Server|3a 20|UploadServer"; content:"Vary|3a 20|Accept-Encoding, Fastly-SSL"; content:"x-api-version|3a 20|F-X"; content:"x-cache|3a 20|HIT"; content:"x-Firefox-Spdy|3a 20|h2"; content:"x-nyt-route|3a 20|vi-assets"; content:"x-served-by|3a 20|cache-mdw17344-MDW"; content:"x-timer|3a 20|S1580937960.346550,VS0,VE0"; fast_pattern; reference:url,github.com/fireeye/red_team_tool_countermeasures; classtype:trojan-activity; sid:2031267; rev:5; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2020_12_08, deployment Perimeter, confidence High, signature_severity Major, tag c2, updated_at 2024_04_14, mitre_tactic_id TA0010, mitre_tactic_name Exfiltration, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)