alert http1 $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Generic Rust Loader Victim HeartBeat"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/beacon|3f|m|3d|"; startswith; fast_pattern; content:"|26|b|3d|"; distance:16; within:3; byte_test:1, >, 0, 0, relative, string, dec; content:"|26|d|3d|"; distance:0; byte_test:1, <, 2, 0, relative, string, dec; content:"|26|h|3d|"; distance:1; within:3; http.header_names; bsize:22; to_lowercase; content:"|0d 0a|connection|0d 0a|host|0d 0a 0d 0a|"; http.connection; bsize:10; content:"Keep-Alive"; threshold:type limit,count 1,seconds 300,track by_src; reference:md5,0db5a2d8ffd84b1e31dc40d8a3d73071; classtype:trojan-activity; sid:2072586; rev:1; metadata:affected_product Windows_Client, attack_target Client_Endpoint, tls_state TLSDecrypt, created_at 2026_10_29, deployment Perimeter, deployment SSLDecrypt, confidence High, signature_severity Critical, tag c2, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2026_10_29, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1071, mitre_technique_name Application_Layer_Protocol; target:src_ip;)