ET WEB_CLIENT c0896 Hacked Site Response Octal (Inbound)

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"ET WEB_CLIENT c0896 Hacked Site Response Octal (Inbound)";
    flow:established,to_client;
    file_data;
    content:"0c0896"; fast_pattern;
    content:"="; distance:0;
    pcre:"/^[^\x22\x27\x3b]*?[\x22\x27](?P<space>[0-7]{1,3})(?P<sep>[^0-9a-f])(?P<f>[0-7]{1,3})(?P=sep)[0-7]{1,3}(?P=sep)(?P<n>(?!(?P=f))[0-7]{1,3})(?P=sep)([0-7]{1,3}(?P=sep)){4}(?P=n)(?P=sep)(?P=space)(?P=sep)(?P<z>(?!((?P=f)|(?P=n)))[0-7]{1,3})(?P=sep)(?P=z)(?P=sep)(?P=z)(?P=sep)(?P=f)(?P=sep)(?P=f)(?P=sep)(?P=f)/R";
    classtype:trojan-activity;
    sid:2017194; rev:3;
    metadata:created_at 2013_07_25, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2019_07_26;
)