Rule History

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE NOBELIUM - Cobalt Strike Malleable Profile M2"; flow:established,to_server; http.method; content:"GET"; http.cookie; bsize:>170; content:".html"; endswith; fast_pattern; http.content_type; content:"text/html"; bsize:9; http.header; content:"Cache-Control|3a 20|no-cache"; reference:url,www.sekoia.io/en/nobeliums-envyscout-infection-chain-goes-in-the-registry-targeting-embassies; classtype:command-and-control; sid:2035216; rev:2; metadata:attack_target Client_Endpoint, created_at 2022_02_18, performance_impact Significant, confidence Medium, signature_severity Major, updated_at 2024_04_30;)