alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET HUNTING Observed Nighthawk 404 Server Response"; flow:established,to_client; http.stat_code; content:"404"; http.response_header; header_lowercase; bsize:9; content:"x-test|3a 20|2"; fast_pattern; file.data; content:"Nothing to see here."; reference:url,twitter.com/1ZRR4H/status/1600569404705619988; reference:url,twitter.com/1ZRR4H/status/1615791320982818830; classtype:bad-unknown; sid:2043331; rev:2; metadata:attack_target Client_Endpoint, created_at 2023_01_18, deployment Perimeter, deployment SSLDecrypt, confidence Medium, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_04_26; target:src_ip;)