alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE MSIL/CrimsonRAT Activity (POST)"; flow:established,to_server; http.request_line; content:"POST /indexer.php HTTP/1.1"; http.request_body; content:"q="; startswith; content:"|7c|ver="; distance:0; fast_pattern; content:"|7c 7c|"; within:4; http.header_names; content:!"Referer|0d 0a|"; content:!"User-Agent|0d 0a|"; content:!"Accept"; reference:url,twitter.com/0xrb/status/1517052777167732736?s=21&t=zTZ6AqU3_DB36dZ3DE1HCg; reference:md5,41702a1959b1b7038237d75330b904b6; classtype:trojan-activity; sid:2036290; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_04_21, deployment Perimeter, malware_family CrimsonRAT, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2022_04_21;)