alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET RETIRED IceApple User-Agent observed"; flow:established,to_server; http.user_agent; content:"Microsoft Office/16.0 |28|Windows NT 10.0|3b 20|Microsoft Outlook 16.0.4551|3b 20|Pro|29|"; http.header_names; to_lowercase; content:!"|0d 0a|referer|0d 0a|"; reference:url,www.crowdstrike.com/wp-content/uploads/2022/05/crowdstrike-iceapple-a-novel-internet-information-services-post-exploitation-framework.pdf; classtype:trojan-activity; sid:2036602; rev:4; metadata:attack_target Server, created_at 2022_05_17, deployment Perimeter, deployment SSLDecrypt, former_category MALWARE, malware_family IceApple, performance_impact Low, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_09_12, reviewed_at 2024_09_12;)