alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/44Caliber Stealer Discord Activity (POST)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/api/webhooks/943188844625428520/64LwO5Gsh0pUZCcm80BNwTcVPihRnEmr1rZOPj02k6T5sRc5Lq4sdaB2KyttNgJHeX3T"; fast_pattern; bsize:101; http.host; content:"discord.com"; endswith; reference:md5,0238e5a4b41c4dcff77e8b01e88bed22; reference:url,twitter.com/c3rb3ru5d3d53c/status/1503449439868014592; classtype:trojan-activity; sid:2035471; rev:2; metadata:attack_target Client_Endpoint, created_at 2022_03_15, deployment Perimeter, deployment SSLDecrypt, malware_family Win32_44Caliber, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2023_03_01;)