Rule History

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/44Caliber Stealer Variant Activity (POST)"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"44CALIBER|20|MODIFIED|20|BY"; nocase; fast_pattern; content:"Build|3a 20|"; distance:0; content:"PC|3a 20|"; distance:0; reference:url,twitter.com/James_inthe_box/status/1431366451231801346; reference:url,app.any.run/tasks/366ad91a-2b9d-4ca0-8e1d-269f61558aa6/; reference:md5,32595ac79386e97e05f876c5dd2ab874; classtype:command-and-control; sid:2033833; rev:2; metadata:attack_target Client_Endpoint, created_at 2021_08_30, deployment Perimeter, deployment SSLDecrypt, malware_family Win32_44Caliber, performance_impact Low, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2023_03_10, reviewed_at 2023_11_07;)