Rule History

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE TA444 Related JS Activity Sending Windows System Process Information (POST)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:!"|2e|"; http.request_body; content:"|7b 22 75 69 64 22 3a 22|"; startswith; content:"|22 2c 20 22 6d 69 64 22 3a 22|"; within:23; fast_pattern; content:"|22 2c 20 22 64 61 74 61 22 3a 22 7c|"; within:36; content:"|7c 53 79 73 74 65 6d 7c|"; distance:0; http.header_names; content:!"Referer"; reference:md5,31af7ca58c844bdc40d367ff91ee55f7; classtype:trojan-activity; sid:2049281; rev:1; metadata:attack_target Client_Endpoint, created_at 2023_11_22, deployment Perimeter, performance_impact Low, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2023_11_22; target:src_ip;)