alert http1 $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING FancyBear/APT28 Related Phish Landing Page 2022-03-08"; flow:established,to_client; http.response_line; content:"HTTP/1.1 200 OK"; file.data; content:"|22|https|3a 2f 2f|webhook.site/d466f7a7-63a1-4c04-8347-fe2d0a96081f"; fast_pattern; reference:url,blog.google/threat-analysis-group/update-threat-landscape-ukraine/; classtype:credential-theft; sid:2035406; rev:3; metadata:attack_target Client_Endpoint, created_at 2022_03_08, deployment Perimeter, deployment SSLDecrypt, malware_family APT28, malware_family Fancy_Bear, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_04_03;)