alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE SharpNoPSExec EXE Lateral Movement Tool Downloaded"; flow:established,to_client; file_data; content:"MZ"; within:2; byte_jump:4,58,relative,little; content:"PE|00 00|"; distance:-64; within:4; content:"S|00|h|00|a|00|r|00|p|00|N|00|o|00|P|00|S|00|E|00|x|00|e|00|c|00 2e 00|e|00|x|00|e"; distance:0; fast_pattern; content:"Z|00|Q|00|B|00|j|00|A|00|G|00|g|00|A|00|b|00|w|00|A|00|g|00|A|00|E|00|c|00|A|00|b|00|w|00|B|00|k|00|A|00|C|00|A|00|A|00|Q|00|g|00|B|00|s|00|A|00|G|00|U|00|A|00|c|00|w|00|B|00|z|00|A|00|C|00|A|00|A|00|W|00|Q|00|B|00|v|00|A|00|H|00|U|00|A|00|I|00|Q|00|A|00 3d|"; distance:0; reference:url,github.com/juliourena/SharpNoPSExec/; classtype:trojan-activity; sid:2032875; rev:2; metadata:attack_target Client_Endpoint, created_at 2021_04_27, deployment Perimeter, performance_impact Low, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2021_04_27;)