alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Fake Rocket Alerts App Sending Phone Information (POST)"; flow:established,to_server; urilen:9; http.method; content:"POST"; http.uri; content:"/file.php"; http.content_type; content:"multipart/form-data|3b|boundary="; startswith; fast_pattern; http.host; pcre:"/^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/"; http.header; pcre:"/^file\x3a\x20[^\r\n]+\x2efinal\r\n/Hm"; http.header_names; to_lowercase; content:!"|0d 0a|referer|0d 0a|"; http.request_body; content:"form-data|3b 20|name=|22|file|22 3b|filename=|22|"; reference:url,blog.cloudflare.com/malicious-redalert-rocket-alerts-application-targets-israeli-phone-calls-sms-and-user-information/; reference:md5,410c6e3af93abde8a8c7801cb14da9e0; classtype:trojan-activity; sid:2049628; rev:2; metadata:attack_target Mobile_Client, created_at 2023_12_08, deployment Perimeter, performance_impact Low, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_04_27; target:src_ip;)