alert http1 $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Cobalt Strike Related Activity (GET)"; flow:established,to_server; http.request_line; content:"GET /async/newtab_ogb HTTP/1.1"; fast_pattern; http.header_names; content:"|0d 0a|Sec-Fetch-Site|0d 0a|Sec-Fetch-Mode|0d 0a|Sec-Fetch-Dest|0d 0a|"; content:!"Referer|0d 0a|"; http.cookie; content:"1P_JAR="; startswith; content:"NID="; distance:6; within:4; pcre:"/^[A-Za-z0-9\/_\-\+]{171}=$/R"; reference:md5,e98774bee4ed490089f6c63b6c676112; reference:url,blog.malwarebytes.com/threat-intelligence/2022/03/new-spear-phishing-campaign-targets-russian-dissidents/; classtype:trojan-activity; sid:2035653; rev:4; metadata:attack_target Client_Endpoint, created_at 2022_03_30, deployment Perimeter, malware_family Cobalt_Strike, confidence Medium, signature_severity Major, updated_at 2024_04_03, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1001, mitre_technique_name Data_Obfuscation;)