alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE MACE C2 Framework Response M1"; flow:established,to_client; flowbits:isset,ET.maceframework; http.stat_code; content:"200"; http.server; content:"BaseHTTP"; fast_pattern; startswith; content:"Python/"; distance:0; http.header; content:!"Content-Length"; file.data; bsize:4; content:"null"; reference:url,github.com/nickvangilder/most-average-c2-ever/; classtype:trojan-activity; sid:2049130; rev:2; metadata:attack_target Client_Endpoint, created_at 2023_11_09, deployment Perimeter, deployment SSLDecrypt, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_27; target:dest_ip;)