alert http1 $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Snojan Variant Sending System Information (GET)"; flow:established,to_server; http.method; content:"GET"; http.uri.raw; content:".php?payload1=NetBios|25 32 30|name|3a 25 32 30|"; fast_pattern; content:"&payload2=Username|3a 25 32 30|"; distance:0; content:"&payload3=Operating|25 32 30|system|3a 25 32 30|"; distance:0; content:"&payload4=Local|25 32 30|IP|3a 25 32 30|"; distance:0; http.header_names; bsize:22; content:"|0d 0a|Host|0d 0a|Connection|0d 0a 0d 0a|"; reference:md5,8313df7915e10fde7b3ee4bbddce4f31; classtype:trojan-activity; sid:2044258; rev:3; metadata:attack_target Client_Endpoint, created_at 2023_02_21, deployment Perimeter, deployment SSLDecrypt, malware_family Win32_Snojan, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_04_03; target:src_ip;)