alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Hakbit/Thanos Ransomware BMP Download"; flow:established,to_server; content:".bmp HTTP/1.1|0d 0a|Host|3a 20|"; fast_pattern; http.method; content:"GET"; http.uri; pcre:"/^\/help(?:me)?\.bmp$/"; http.header_names; content:"Host|0d 0a|Connection|0d 0a 0d 0a|"; content:!"User-Agent"; content:!"Referer"; content:!"Accept-"; reference:url,labs.sentinelone.com/thanos-ransomware-riplace-bootlocker-and-more-added-to-feature-set/; reference:md5,c78a9c6affbfbfabfc50fae515675c6a; reference:md5,acbf8739dce846472a7715c975dc8b40; classtype:trojan-activity; sid:2030485; rev:1; metadata:attack_target Client_Endpoint, created_at 2020_07_08, deployment Perimeter, malware_family hakbit, malware_family thanos, confidence High, signature_severity Major, tag Ransomware, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_07_08, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;)