alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/DoNot Observed UA (Mozilla 105.01.05)"; flow:established,to_server; http.user_agent; bsize:17; content:"Mozilla|20|105|2e|01|2e|05"; fast_pattern; reference:md5,de809098792b7677a3debe555ff5fe26; reference:url,twitter.com/jaydinbas/status/1617853748063383552; classtype:trojan-activity; sid:2043987; rev:3; metadata:attack_target Client_Endpoint, created_at 2023_01_24, deployment Perimeter, deployment SSLDecrypt, malware_family Win32_DoNot, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_27;)