alert http $HTTP_SERVERS any -> $EXTERNAL_NET any (msg:"ET WEB_CLIENT APT/Hafnium SPORTSBALL Webshell Observed Outbound"; flow:established,to_client; file.data; content:"<td>logon|3a|<td>"; content:"name=|22|sport|22 20|"; distance:0; content:"<td>cmd|3a|"; distance:0; content:"input|20|name=|22|balls|22 20|"; fast_pattern; content:"name=|22|woods|22|"; content:"name=|22|sky|22|"; reference:md5,1a4ab99bbe9adbe2deb0e4b96d82a955; classtype:web-application-attack; sid:2031812; rev:2; metadata:attack_target Web_Server, created_at 2021_03_04, deployment Perimeter, performance_impact Low, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2021_03_04;)