alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE TransparentTribe Related CnC Activity"; flow:established,to_server; content:"x999"; startswith; fast_pattern; content:">"; distance:0; pcre:"/>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}>/"; content:"|20|>>"; reference:md5,ae20da9a88c7624a6b3f81a20bc8065c; reference:url,twitter.com/s1ckb017/status/1435888576710029315; reference:url,blog.cyble.com/2021/09/14/apt-group-targets-indian-defense-officials-through-enhanced-ttps/; classtype:trojan-activity; sid:2033962; rev:1; metadata:created_at 2021_09_16, malware_family TransparentTribe, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2021_09_16;)