alert tcp $HOME_NET any -> $EXTERNAL_NET 443 (msg:"ET MALWARE Win32/BugSleep CnC Checkin"; flow:established,to_server; flowbits:noalert; xbits:set,ET.BugSleep.C2,track ip_dst,expire 60; content:"|fd fd fd|"; offset:1; depth:3; fast_pattern; content:"|2c|"; within:255; reference:url,blog.talosintelligence.com/writing-a-bugsleep-c2-server/; reference:url,blog.sekoia.io/muddywater-replaces-atera-by-custom-muddyrot-implant-in-a-recent-campaign/; reference:url,research.checkpoint.com/2024/new-bugsleep-backdoor-deployed-in-recent-muddywater-campaigns/; classtype:trojan-activity; sid:2057160; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, affected_product Windows_11, attack_target Client_and_Server, tls_state plaintext, created_at 2024_10_30, deployment Perimeter, deployment Internal, malware_family Win32_BugSleep, performance_impact Low, confidence High, signature_severity Major, updated_at 2024_11_01; target:src_ip;)