alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE TA422 Related Activity M5"; flow:established,to_client; flowbits:isset,ET.TA422.Mockingbird; http.stat_code; content:"302"; http.location; content:"https|3a 2f 2f|run.mocky.io/v3/"; fast_pattern; classtype:trojan-activity; sid:2049288; rev:1; metadata:created_at 2023_11_16, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2023_11_22, former_sid 2855828;)