alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO Bluetrait RMM Heartbeat Check-in Observed"; flow:established,to_server; flowbits:set,ET.Bluetrait.Heartbeat.Checkin; http.method; content:"POST"; http.uri; bsize:5; content:"/api/"; http.host; content:"bluetrait.io"; fast_pattern; endswith; http.request_body; content:"|7b 22|api_action|22 3a 22|msp|22 2c 22|api_version|22 3a 22|"; startswith; content:"|22 2c 22|task|22 3a 22|checkin|22 2c 22|uuid|22 3a 22|"; within:40; pcre:"/^[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}/R"; content:"|22 2c 22|data|22 3a 22 7b 5c 22|name|5c 22 3a 5c 22|"; within:80; reference:url,bluetrait.io; classtype:misc-activity; sid:2057027; rev:1; metadata:affected_product Bluetrait_RMM, attack_target Client_Endpoint, tls_state TLSDecrypt, created_at 2024_10_23, deployment Perimeter, deployment Internal, deployment SSLDecrypt, performance_impact Low, confidence High, signature_severity Informational, updated_at 2024_10_23; target:src_ip;)