alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Possible Racoon Stealer Retrieving Google Account Details (GET)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"|2f|InteractiveLogin|3f|continue|3d|https|3a 2f 2f|www|2e|youtube|2e|com|2f|getAccountSwitcherEndpoint|26|followup|3d|https|3a 2f 2f|www|2e|youtube|2e|com|2f|getAccountSwitcherEndpoint|26|passive|3d|"; startswith; fast_pattern; content:"&service=youtube&"; http.cookie; content:"NID="; startswith; content:"OGPC="; content:"|3a 3b 20|AEC|3d|A"; content:"VISITOR_INFO1_LIVE="; http.content_type; content:"application/json"; http.host; content:"accounts.google.com"; reference:md5,084f0d74d04cbec4287b39b7a2d0b89f; reference:url,twitter.com/Gi7w0rm/status/1641488122302148635; classtype:misc-activity; sid:2044835; rev:1; metadata:attack_target Client_Endpoint, created_at 2023_03_30, deployment Perimeter, deployment SSLDecrypt, malware_family Raccoon_Stealer, performance_impact Moderate, confidence Medium, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2023_03_30;)