alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Vicious Panda CnC Activity"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/tel/1214"; startswith; fast_pattern; http.header_names; content:"|0d 0a|Host|0d 0a|Pragma|0d 0a|Accept|0d 0a 0d 0a|"; bsize:26; http.accept; content:"image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*"; bsize:56; reference:md5,3009db32ca8895a0f15f724ba12a6711; reference:url,research.checkpoint.com/2020/vicious-panda-the-covid-campaign/; reference:url,twitter.com/dewan202/status/1244595728175030272; classtype:command-and-control; sid:2030921; rev:1; metadata:attack_target Client_Endpoint, created_at 2020_09_29, deployment Perimeter, performance_impact Low, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_09_29;)