ET WEB_SERVER c0896 Hacked Site Response Hex (Outbound)

alert http $HTTP_SERVERS any -> $EXTERNAL_NET any (
    msg:"ET WEB_SERVER c0896 Hacked Site Response Hex (Outbound)";
    flow:established,to_client;
    file_data;
    content:"0c0896"; fast_pattern;
    content:"="; distance:0;
    pcre:"/^[^\x22\x27\x3b]*?[\x22\x27](?P<space>[a-f0-9]{2})(?P<sep>[^0-9a-f])(?P<f>[a-f0-9]{2})(?P=sep)[a-f0-9]{2}(?P=sep)(?P<n>(?!(?P=f))[a-f0-9]{2})(?P=sep)([a-f0-9]{2}(?P=sep)){4}(?P=n)(?P=sep)(?P=space)(?P=sep)(?P<z>(?!((?P=f)|(?P=n)))[a-f0-9]{2})(?P=sep)(?P=z)(?P=sep)(?P=z)(?P=sep)(?P=f)(?P=sep)(?P=f)(?P=sep)(?P=f)/R";
    classtype:trojan-activity;
    sid:2017193; rev:3;
    metadata:created_at 2013_07_25, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2019_07_26;
)