alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE NOBELIUM - Cobalt Strike Malleable Profile M1"; flow:established,to_server; urilen:>150; http.method; content:"GET"; http.uri; content:"v1.5472"; endswith; fast_pattern; http.content_type; content:"text/html"; bsize:9; http.header; content:"Cache-Control|3a 20|no-cache"; reference:url,www.sekoia.io/en/nobeliums-envyscout-infection-chain-goes-in-the-registry-targeting-embassies; classtype:command-and-control; sid:2034868; rev:2; metadata:attack_target Client_Endpoint, created_at 2021_12_07, deployment Perimeter, malware_family Cobalt_Strike, confidence Medium, signature_severity Major, updated_at 2021_12_07, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1001, mitre_technique_name Data_Obfuscation;)