alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Possible APT-12 Related C2"; flow:to_server,established; http.uri; content:"/url.asp?"; content:"-ShowNewsID-"; fast_pattern; distance:0; pcre:"/=[A-Za-z0-9\/\+]+={0,2}$/"; reference:url,community.rapid7.com/community/infosec/blog/2013/08/26/upcoming-g20-summit-fuels-espionage-operations; classtype:targeted-activity; sid:2017386; rev:3; metadata:created_at 2013_08_28, confidence Medium, signature_severity Major, updated_at 2020_04_24;)