Rule History

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE TA399/Sidewinder Activity Payload Request M2, Microsoft Office UA Request for .rtf"; flow:established,to_server; http.method; content:"GET"; http.uri; content:".rtf"; endswith; fast_pattern; http.user_agent; content:"|3b 20|ms-office|3b 20|"; http.header_names; content:!"Referer"; reference:url,twitter.com/ShadowChasing1/status/1433038639961804800; reference:md5,c9f8addb927c3b96aee6a9f671a1f801; classtype:command-and-control; sid:2033858; rev:4; metadata:attack_target Client_Endpoint, tls_state TLSDecrypt, created_at 2021_09_01, deployment Perimeter, deployment SSLDecrypt, confidence High, signature_severity Major, tag TA399, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_09_26, reviewed_at 2023_08_22;)