alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE CHAOS RAT/AlfaC2 CnC Server Status Check"; flow:established,to_server; http.uri; bsize:7; content:"/health"; http.user_agent; content:"Go-http-client/"; startswith; http.content_type; bsize:16; content:"application/json"; http.cookie; content:"jwt="; startswith; content:".eyJhdXRob3JpemVkIj"; fast_pattern; distance:0; content:!"|3b|"; distance:0; reference:md5,d0ea84204096109f18a2201fae1c4f30; reference:url,github.com/tiagorlampert/CHAOS; classtype:command-and-control; sid:2046873; rev:1; metadata:attack_target Client_and_Server, created_at 2023_07_20, deployment Perimeter, malware_family CHAOS, performance_impact Low, confidence Medium, signature_severity Critical, tag RemoteAccessTool, updated_at 2023_11_27; target:src_ip;)