alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Gamaredon APT Related CnC Activity (POST) M3"; flow:established,to_server; http.method; content:"POST"; http.uri; content:".html=?"; http.user_agent; content:"|3b 3b 2f|"; fast_pattern; http.header_names; content:!"Referer"; reference:url,twitter.com/StopMalvertisin/status/1674460280900947970; reference:md5,b9b76f5c34a0788e10ae6cb95a0e1453; reference:md5,1f5e6d502290f9ece3f0e7047facc7b6; classtype:command-and-control; sid:2046701; rev:1; metadata:attack_target Client_Endpoint, created_at 2023_06_30, deployment Perimeter, deployment SSLDecrypt, performance_impact Low, confidence High, signature_severity Critical, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2023_06_30; target:src_ip;)