ET MALWARE EARTHWORM SOCKS Reverse Proxy Tunnel Request

#alert tcp-pkt any any -> any any (
#    msg:"ET MALWARE EARTHWORM SOCKS Reverse Proxy Tunnel Request";
#    flow:established,to_server;
#    flowbits:set,ET.earthworm.request.stage1;
#    flowbits:noalert;
#    dsize:6;
#    content:"|01 04|"; fast_pattern; startswith;
#    reference:url,community.emergingthreats.net/t/sig-earthworm-reverse-socks-handshake-and-tunnel-sequence-detection/3314;
#    classtype:trojan-activity;
#    sid:2069305; rev:1;
#    metadata:affected_product Any, attack_target Client_and_Server, tls_state plaintext, created_at 2026_05_14, deployment Perimeter, deployment Internal, malware_family EarthWorm, performance_impact Significant, confidence High, signature_severity Major, tag SOCKS_Reverse_Proxy, updated_at 2026_05_14, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1090, mitre_technique_name Proxy;
#)