alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/GoPix Stealer Activity (POST)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/1/"; bsize:3; http.header_names; content:"|0d 0a|Content-Length|0d 0a|Expect|0d 0a|Connection|0d 0a 0d 0a|"; endswith; fast_pattern; content:!"Referer"; content:!"User-Agent"; http.request_body; pcre:"/^[A-Za-z]{4}$/"; reference:md5,ed4cb0ff27bb91b5e285db2a40480b6e; reference:md5,9ae0fbbbacd62f0bf1826493c58478be; reference:md5,eb0b4e35a2ba442821e28d617dd2daa2; reference:url,securelist.com/crimeware-report-gopix-lumar-rhysida/110871/; classtype:trojan-activity; sid:2049716; rev:1; metadata:attack_target Client_Endpoint, created_at 2023_12_18, deployment Perimeter, malware_family Win32_GoPix, performance_impact Moderate, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2023_12_18; target:src_ip;)