alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Cobalt Strike Beacon Activity (GET)"; flow:established,to_server; urilen:3; http.method; content:"GET"; http.cookie; content:"reg_fb_gate="; startswith; fast_pattern; pcre:"/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$/R"; http.header_names; content:!"Referer"; reference:md5,bed512b1b901f03d421d39132a6c75b6; reference:url,thedfirreport.com/2021/08/01/bazarcall-to-conti-ransomware-via-trickbot-and-cobalt-strike/; classtype:trojan-activity; sid:2033669; rev:1; metadata:attack_target Client_Endpoint, created_at 2021_08_04, deployment Perimeter, deployment SSLDecrypt, performance_impact Low, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2021_08_04;)