alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE SiameseKitten/Lyceum/Hexane MSIL/Shark CnC Checkin"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"?q="; content:"&qi="; distance:0; content:"&q1="; distance:0; content:"&q2="; distance:0; content:"&q3="; distance:0; pcre:"/^(?:[A-Z0-9+/]{4})*(?:[A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})/R"; http.user_agent; content:"|28|Windows|20|NT|20|10.0|3b 20|Win64|3b 20|x64|29|"; http.header_names; to_lowercase; content:"if-none-match|0d 0a|sec-fetch-dest|0d 0a|sec-fetch-mode|0d 0a|sec-fetch-user|0d 0a|"; nocase; http.request_header; header_lowercase; bsize:24; content:"sec-fetch-dest|3a 20|document"; fast_pattern; startswith; reference:url,www.accenture.com/us-en/blogs/cyber-defense/iran-based-lyceum-campaigns; reference:url,www.clearskysec.com/siamesekitten/; classtype:command-and-control; sid:2033760; rev:3; metadata:created_at 2021_08_22, malware_family Shark, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_04_25;)