alert http [$HOME_NET,$SMTP_SERVERS] any -> any any (msg:"ET MALWARE OWAReaper C2 Beacon"; flow:established,to_server; http.uri; content:"/assets/v1_"; pcre:"/^[A-Za-z0-9\x2d\x5f]+$/R"; classtype:trojan-activity; sid:2071331; rev:1; metadata:attack_target Client_Endpoint, created_at 2026_07_28, deployment Perimeter, malware_family OWAReaper, confidence High, signature_severity Major, tag c2, updated_at 2026_07_28, former_sid 2868079, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1071, mitre_technique_name Application_Layer_Protocol; target:src_ip;)