alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE HabitsRAT Checkin"; flow:established,to_server; http.request_line; content:"POST /checkin"; startswith; fast_pattern; http.user_agent; content:"Go-http-client/1.1"; bsize:18; http.request_body; content:"goarch="; content:"goos="; content:"hostname="; content:"no_replay="; content:"public_key="; reference:url,www.intezer.com/blog/malware-analysis/habitsrat-used-to-target-linux-and-windows-servers; reference:md5,2177fb8f49934333a201197d6f55378d; classtype:command-and-control; sid:2032791; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2021_04_20, deployment Perimeter, deployment SSLDecrypt, malware_family HabitsRAT, performance_impact Low, confidence High, signature_severity Major, updated_at 2021_04_20;)