alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Ousaban Related Maldoc Activity"; flow:established,to_server; http.method; content:"GET"; http.uri; bsize:12; content:"/ZP/MIKV.php"; fast_pattern; http.user_agent; bsize:26; content:"Embarcadero|20|URI|20|Client/1.0"; http.header_names; to_lowercase; content:!"|0d 0a|referer|0d 0a|"; content:!"|0d 0a|accept"; reference:url,twitter.com/ESETresearch/status/1376490532445294594; reference:md5,ad8fd5461bec26b97cdfc0b05028bfc0; reference:md5,1e4b45e2ab5c679f9e983da1c135ab5e; reference:md5,34db9c98f3149d98bf0a562ce2ef5344; classtype:trojan-activity; sid:2032356; rev:3; metadata:attack_target Client_Endpoint, created_at 2021_03_31, deployment Perimeter, performance_impact Low, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_04_20;)