alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Cobalt Strike Malleable C2 Amazon Profile Variant (GET)"; flow:established,to_server; http.method; content:"GET"; http.uri; bsize:72; content:"/s/re1f=n1b_s1b_n1oss_1/1617-3222948188-02162949/fie1ld-keyw1ords=bo1oks"; http.header; header_lowercase; content:"cook1ie|3a 20|skin|3d|nosk111in|3b|"; fast_pattern; reference:md5,c05f3ef094c103163d2fae6932e1c324; reference:url,twitter.com/obfusor/status/1539945037563174912; classtype:trojan-activity; sid:2037096; rev:3; metadata:attack_target Client_Endpoint, created_at 2022_06_23, deployment Perimeter, deployment SSLDecrypt, malware_family Cobalt_Strike, confidence Medium, signature_severity Major, updated_at 2024_04_30, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1001, mitre_technique_name Data_Obfuscation;)