alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Suspected MuddyWater Related CnC Activity"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/getTargetInfo?guid="; startswith; fast_pattern; content:"&status="; distance:0; http.host; pcre:"/^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/"; http.header_names; content:!"Referer"; reference:md5,c9ab403bd43649b5fd57efac4bf83b7c; reference:md5,748ae5af58e52e940ab806bdbbe61c4c; reference:url,twitter.com/ShadowChasing1/status/1475819281648553986; classtype:trojan-activity; sid:2034845; rev:1; metadata:attack_target Client_Endpoint, created_at 2021_12_28, deployment Perimeter, malware_family MuddyWater, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2021_12_28;)