alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Sharik/Smoke Loader Microsoft Connectivity Check"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/fwlink/?LinkId="; fast_pattern; http.header; content:!"SOAPAction|3a|"; http.user_agent; content:!"MICROSOFT_DEVICE_METADATA_RETRIEVAL_CLIENT"; http.host; content:"go.microsoft.com"; startswith; http.header_names; content:!"Referer|0d 0a|"; content:!"Accept"; reference:md5,467b786f7c645c73d5c29347d35cae11; classtype:trojan-activity; sid:2022124; rev:8; metadata:created_at 2015_11_20, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_10_07;)