alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE OSX/Mokes.A CnC Heartbeat Request (set)"; flow:established,to_server; urilen:3; flowbits:set,ET.OSX.Mokes; flowbits:noalert; http.method; content:"GET"; http.uri; content:"/v1"; http.header; content:"Safari/7046A194A|0d 0a|"; fast_pattern; http.connection; content:"Close"; bsize:5; http.header_names; content:"|0d 0a|Connection|0d 0a|User-Agent|0d 0a|Accept-Encoding|0d 0a|Accept-Language|0d 0a|Host|0d 0a 0d 0a|"; startswith; reference:url,securelist.com/blog/research/75990/the-missing-piece-sophisticated-os-x-backdoor-discovered; classtype:command-and-control; sid:2023182; rev:3; metadata:affected_product Mac_OSX, created_at 2016_09_08, deployment Perimeter, malware_family OSX_Mokes_A, confidence High, signature_severity Major, tag OSX_Malware, updated_at 2020_07_27;)