Rule History

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE OSX/SHLAYER CnC Checkin"; flow:established,to_server; http.request_line; content:"POST http://"; fast_pattern; http.uri; content:"/l"; bsize:2; http.host; content:"api."; startswith; http.header_names; content:"|0d 0a|Host|0d 0a|Content-Length|0d 0a|Content-Type|0d 0a|Accept|0d 0a|Connection|0d 0a 0d 0a|"; content:!"User-Agent"; content:!"Referer"; http.request_body; content:"cs="; startswith; pcre:"/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})/R"; http.content_type; content:"application/x-www-form-urlencoded"; bsize:33; threshold:type limit, count 1, seconds 600, track by_dst; reference:md5,4d86ae25913374cfcb80a8d798b9016e; reference:url,securelist.com/shlayer-for-macos/95724/; classtype:command-and-control; sid:2030231; rev:5; metadata:affected_product Mac_OSX, attack_target Client_Endpoint, created_at 2020_05_29, deployment Perimeter, malware_family OSX_SHLAYER, performance_impact Moderate, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_04_04;)