alert http1 $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Mutter Backdoor Checkin"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/index.aspx?i="; fast_pattern; http.header_names; content:"|0d 0a|Host|0d 0a|"; content:"|0d 0a|Connection|0d 0a|"; pcre:"/^\x0d\x0a(?:Connection|Host)\x0d\x0a(?:Connection|Host)\x0d\x0a\x0d\x0a$/"; reference:url,fireeye.com/blog/technical/malware-research/2013/04/the-mutter-backdoor-operation-beebus-with-new-targets.html; classtype:command-and-control; sid:2016773; rev:7; metadata:created_at 2013_04_19, signature_severity Major, updated_at 2024_04_07;)