alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Suspected Gamaredon APT Related Activity"; flow:established,to_server; urilen:>30; http.method; content:"GET"; http.uri; content:"-"; pcre:"/^.*\.[0-9a-z]{5}$/R"; http.user_agent; content:"|3b 20|ms-office|3b 20|"; fast_pattern; http.header_names; content:!"|0d 0a|referer|0d 0a|"; http.host; content:!"link.email.newbalance.co.uk"; content:!"ibyteimg.com"; content:!"cisco.com"; reference:md5,de9a87a8dc9eb67b3e54c452f63b2579; classtype:bad-unknown; sid:2045872; rev:4; metadata:attack_target Client_Endpoint, created_at 2023_05_26, performance_impact Low, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2025_11_10, reviewed_at 2024_02_27; target:src_ip;)