alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Parrot TDS Check 2024-06-17"; flow:established,to_client; content:"|3d 21 21 5b 5d 2c|HttpClient|3d|function|28 29|"; fast_pattern; content:"|3d|new|20|XMLHttpRequest|28 29 3b|"; within:512; reference:url,unit42.paloaltonetworks.com/parrot-tds-javascript-evolution-analysis/; classtype:exploit-kit; sid:2053697; rev:1; metadata:attack_target Client_Endpoint, tls_state TLSDecrypt, created_at 2024_06_17, deployment Perimeter, deployment SSLDecrypt, performance_impact Low, confidence Medium, signature_severity Major, tag TDS, tag Parrot_TDS, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_06_17;)