alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE WEBC2-CSON Checkin - APT1 Related"; flow:established,to_server; http.uri; content:"/Default.aspx?INDEX="; pcre:"/\?ID=[A-Z]{10}$/"; http.user_agent; content:!"Mozilla"; startswith; reference:md5,8dd6a7fe83bd9682187d956f160ffb47; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=TrojanDownloader%3AWin32%2FSmall.XR; reference:md5,ba45339da92ca4622b472ac458f4c8f2; reference:url,intelreport.mandiant.com/; classtype:targeted-activity; sid:2016460; rev:9; metadata:created_at 2011_10_06, deprecation_reason Relevance, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_01_11, reviewed_at 2024_01_11;)