alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/CosmicRust TA444 CnC Activity (GET)"; flow:established,to_server; urilen:7; http.method; content:"GET"; http.uri; content:"/client"; http.header_names; content:"|0d 0a|Sec-WebSocket-Protocol|0d 0a|Host|0d 0a|Connection|0d 0a|Upgrade|0d 0a|Sec-WebSocket-Version|0d 0a|Sec-WebSocket-Key|0d 0a 0d 0a|"; bsize:97; http.connection; content:"Upgrade"; http.header; content:"Connection|3a 20|Upgrade|0d 0a|Upgrade|3a 20|websocket|0d 0a|Sec|2d|WebSocket|2d|Version|3a 20|13|0d 0a|Sec|2d|WebSocket|2d|Key|3a|"; content:"Sec|2d|WebSocket|2d|Protocol|3a 20|rust|2d|websocket|2c 20|ping|0d 0a|Host|3a 20|"; fast_pattern; classtype:trojan-activity; sid:2047748; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2023_08_24, deployment Perimeter, malware_family Win32_CosmicRust, confidence Medium, signature_severity Critical, tag TA444, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2023_08_24, reviewed_at 2023_08_24, former_sid 2855179;)