alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Suspected APT LuckyMouse BlueTraveller CnC"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/home/"; startswith; pcre:"/^[0-9]{4}\/[0-9]{4}\/[^\r\n]+(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$/R"; http.header_names; content:"|0d 0a|User-Agent|0d 0a|Host|0d 0a|Cache-Control|0d 0a|"; startswith; fast_pattern; content:!"Referer"; content:!"Accept"; pcre:"/Cache-Control\r\n(?:\r\n|Cookie\r\n\r\n)$/"; reference:url,decoded.avast.io/luigicamastra/apt-group-targeting-governmental-agencies-in-east-asia/; classtype:command-and-control; sid:2031316; rev:2; metadata:attack_target Client_Endpoint, created_at 2020_12_11, deployment Perimeter, malware_family apt27, malware_family luckymouse, performance_impact Moderate, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_12_22;)