alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE BlueNoroff APT Related Activity M1 (POST)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:!"|2e|"; http.user_agent; content:!"nbp "; startswith; nocase; content:"|20 28|unknown version|29 20|"; fast_pattern; content:"Darwin/"; http.header_names; content:!"Referer"; http.content_type; content:"application/json"; bsize:16; reference:md5,9294648d744703cfa0456ec74d014fe4; reference:md5,a446402c1de5dfddd50b77a95fcfc671; reference:url,www.jamf.com/blog/bluenoroff-strikes-again-with-new-macos-malware/; classtype:trojan-activity; sid:2049882; rev:2; metadata:attack_target Client_Endpoint, created_at 2024_01_02, deployment Perimeter, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_01_29; target:src_ip;)