alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Mana Tools-Lone Wolf Admin Panel Inbound"; flow:established,to_client; http.response_body; content:"|3c|title|3e|Login|3c 2f|title|3e|"; content:"|3c|h3|20|class|3d 22|box|2d|title|20|m|2d|b|2d|20|22 3e|Lone|20|Wolf|3c 2f|h3|3e|"; fast_pattern; content:"placeholder|3d 22|Password|22 20|name|3d 22|Password|22 3e|"; content:"type|3d 22|submit|22 3e|Log|20|In|3c 2f|button|3e|"; reference:url,twitter.com/0xToxin/status/1663588503089737729; classtype:trojan-activity; sid:2045885; rev:1; metadata:attack_target Client_Endpoint, created_at 2023_05_30, deployment Perimeter, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2023_05_30;)