alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE ProjectSauron Remsec CnC Beacon (hardcoded HTTP headers)"; flow:established,to_server; http.header; header_lowercase; content:"accept|3a 20|text|2f|html|2c|text|2f|plain|2c 2a 2f 2a 0d 0a|accept-language|3a 20|en-us|0d 0a|accept-charset|3a 20|ISO-8859-1|2c 2a 0d 0a|keep-alive|3a 20|300|0d 0a|connection|3a 20|Keep-Alive|0d 0a|cache-control|3a 20|No-Cache"; fast_pattern; reference:url,securelist.com/analysis/publications/75533/faq-the-projectsauron-apt; reference:url,www.symantec.com/connect/blogs/strider-cyberespionage-group-turns-eye-sauron-targets; classtype:command-and-control; sid:2023032; rev:5; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2016_08_09, deployment Perimeter, confidence Medium, signature_severity Major, tag c2, updated_at 2024_04_30, mitre_tactic_id TA0010, mitre_tactic_name Exfiltration, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)