alert tcp any any -> any any (msg:"ET MALWARE Polonium APT PAPACREEP Backdoor Related Activity"; flow:established,to_server; content:"Content-length|3a|1024"; content:"Content-Type|3a|text/-html"; distance:0; fast_pattern; reference:url,www.welivesecurity.com/2022/10/11/polonium-targets-israel-creepy-malware/; classtype:trojan-activity; sid:2039152; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_10_11, deployment Perimeter, malware_family Polonium, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2022_10_11;)