alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE BlueNoroff APT Related Activity M2 (POST)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:!"|2e|"; http.user_agent; content:!"nbp "; startswith; nocase; content:"|20 28|unknown version|29 20|"; fast_pattern; content:"Darwin/"; http.header_names; to_lowercase; content:!"|0d 0a|referer|0d 0a|"; http.content_type; bsize:16; content:"application/json"; http.request_body; content:"|22 3a 22|Version|20|"; reference:md5,9294648d744703cfa0456ec74d014fe4; reference:md5,a446402c1de5dfddd50b77a95fcfc671; reference:url,www.jamf.com/blog/bluenoroff-strikes-again-with-new-macos-malware/; classtype:trojan-activity; sid:2049883; rev:4; metadata:attack_target Client_Endpoint, created_at 2024_01_02, deployment Perimeter, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_04_30; target:src_ip;)