alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Rhadamanthys Stealer - Payload Download Request"; flow:established,to_server; http.method; content:"GET"; http.header_names; to_lowercase; content:"|0d 0a|x-csrf-token|0d 0a|cookie|0d 0a 0d 0a|"; endswith; http.cookie; content:"CSRF-TOKEN="; startswith; content:"==|3b 20|LANG=en-US"; distance:86; within:15; endswith; http.header.raw; pcre:"/X-CSRF-TOKEN\x3a\x20(?P<string>[a-zA-Z0-9\+\/]{86}\x3d\x3d)[\r\n]+Cookie\x3a\x20CSRF-TOKEN\x3d(?P=string)\x3b\x20LANG\x3den-US[\r\n]+$/i"; reference:url,threatmon.io/rhadamanthys-stealer-analysis-threatmon/; reference:md5,6c7f6d2ac093abd0edcd16e29de79dd5; classtype:command-and-control; sid:2043202; rev:2; metadata:attack_target Client_Endpoint, created_at 2023_01_04, deployment Perimeter, malware_family Rhadamanthys, performance_impact Low, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_04_26;)