alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Kimsuky APT Related Host Data Exfil M4"; flow:established,to_server; http.method; content:"GET"; http.uri; pcre:"/\/\?m=[a-z]&p1=[a-z0-9]{8,12}(?:&p2=[^&]+)?(?:&p3=[^&]+)?$/i"; content:"/?m="; fast_pattern; content:"&p1="; distance:1; within:4; content:!","; http.header_names; to_lowercase; content:!"|0d 0a|content-type|0d 0a|"; content:!"|0d 0a|referer|0d 0a|"; reference:md5,2d1f1132ab7e80a6a8546dd2ac45bd89; reference:url,download.ahnlab.com/global/brochure/Analysis%20Report%20of%20Kimsuky%20Group.pdf; classtype:targeted-activity; sid:2035564; rev:3; metadata:attack_target Client_Endpoint, created_at 2022_03_23, deployment Perimeter, malware_family Kimsuky, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_04_26;)