alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE NOBELIUM - Cobalt Strike Malleable Profile M1"; flow:established,to_server; urilen:>150; http.method; content:"GET"; http.uri; content:"v1.5472"; endswith; fast_pattern; http.content_type; bsize:9; content:"text/html"; http.header; header_lowercase; content:"cache-control|3a 20|no-cache"; reference:url,www.sekoia.io/en/nobeliums-envyscout-infection-chain-goes-in-the-registry-targeting-embassies; classtype:command-and-control; sid:2034868; rev:4; metadata:attack_target Client_Endpoint, created_at 2021_12_07, deployment Perimeter, malware_family Cobalt_Strike, confidence Medium, signature_severity Major, updated_at 2024_04_30, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1001, mitre_technique_name Data_Obfuscation;)