alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/SiMay RAT Activity M2 (GET)"; flow:established,to_server; http.method; content:"GET"; http.request_line; content:"&shareKey=f83f6c6da089d58ea8538c71344b8e64 HTTP/1.0"; fast_pattern; endswith; http.host; content:"note.youdao.com"; reference:md5,d99b6ea197ed91d2a3348b03bb56514d; reference:md5,8205ccb910dc783efcd7d480ef1bd7d9; reference:url,www.sentinelone.com/wp-content/uploads/2022/04/SiMay-RAT.pdf; classtype:trojan-activity; sid:2036679; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_05_25, deployment Perimeter, malware_family SiMayRAT, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2022_05_25;)