alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Golang/Kaos/YamaBot CnC Activity M2 (POST)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:".php"; endswith; http.user_agent; content:"TW96"; startswith; fast_pattern; pcre:"/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$/"; http.header_names; content:!"Referer"; reference:md5,cf1a90e458966bcba8286d46d6ab052c; reference:md5,612538328e0c4f3e445fb58ef811336a; reference:md5,76125115415a80c4ec4c9b1a440f6054; reference:url,blogs.jpcert.or.jp/ja/2022/06/yamabot.html; classtype:trojan-activity; sid:2037252; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_07_01, deployment Perimeter, malware_family Lazarus, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2022_07_01;)