alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Ousaban Related Maldoc Activity"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/ZP/MIKV.php"; bsize:12; fast_pattern; http.user_agent; content:"Embarcadero|20|URI|20|Client/1.0"; bsize:26; http.header_names; content:!"Referer"; content:!"Accept"; reference:url,twitter.com/ESETresearch/status/1376490532445294594; reference:md5,ad8fd5461bec26b97cdfc0b05028bfc0; reference:md5,1e4b45e2ab5c679f9e983da1c135ab5e; reference:md5,34db9c98f3149d98bf0a562ce2ef5344; classtype:trojan-activity; sid:2032356; rev:1; metadata:attack_target Client_Endpoint, created_at 2021_03_31, deployment Perimeter, performance_impact Low, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2021_03_31;)