alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE SiameseKitten/Lyceum/Hexane MSIL/Shark CnC Checkin"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"?q="; content:"&qi="; distance:0; content:"&q1="; distance:0; content:"&q2="; distance:0; content:"&q3="; distance:0; pcre:"/^(?:[A-Z0-9+/]{4})*(?:[A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})/R"; http.user_agent; content:"|28|Windows|20|NT|20|10.0|3b 20|Win64|3b 20|x64|29|"; http.header_names; content:"If-None-Match|0d 0a|Sec-Fetch-Dest|0d 0a|Sec-Fetch-Mode|0d 0a|Sec-Fetch-User|0d 0a|"; nocase; http.header; content:"Sec-Fetch-Dest|3a 20|document|0d|"; fast_pattern; reference:url,www.accenture.com/us-en/blogs/cyber-defense/iran-based-lyceum-campaigns; reference:url,www.clearskysec.com/siamesekitten/; classtype:command-and-control; sid:2033760; rev:2; metadata:created_at 2021_08_22, malware_family Shark, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2021_09_08;)