alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/Waterspout.APT Backdoor CnC Beacon"; flow:established,to_server; http.method; content:"GET"; http.uri; content:".php?"; content:"_id="; distance:3; within:4; fast_pattern; pcre:"/\/\d{5}\/(?P<s1>[a-z]{3})[a-z]\.php\?(?P=s1)_id=(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$/"; reference:url,www.fireeye.com/blog/technical/botnet-activities-research/2014/09/darwins-favorite-apt-group-2.html; classtype:targeted-activity; sid:2019115; rev:7; metadata:attack_target Client_Endpoint, created_at 2014_09_05, deployment Perimeter, signature_severity Major, tag c2, updated_at 2024_03_06, mitre_tactic_id TA0010, mitre_tactic_name Exfiltration, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)