alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE DeathStalker/Powersing CnC Checkin"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"|22|un|22 3a|"; content:"|22|cn|22 3a|"; distance:0; content:"|22|av|22 3a|"; distance:0; content:"|22|dob|22 3a|"; distance:0; fast_pattern; content:"|22|os|22 3a|"; distance:0; content:"|22|ou|22 3a|"; distance:0; content:"|22|dc|22 3a|"; distance:0; reference:url,securelist.com/deathstalker-mercenary-triumvirate/98177/; classtype:command-and-control; sid:2030726; rev:1; metadata:created_at 2020_08_24, deployment Perimeter, malware_family Powersing, confidence High, signature_severity Major, tag APT, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_08_24;)