alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Earth Minotaur MOONSHINE Exploit Kit URI Struct Detected"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/api/v1/things/web|3f|going|3d|wPol3ljdKj"; fast_pattern; startswith; reference:url,www.trendmicro.com/en_us/research/24/l/earth-minotaur.html; classtype:trojan-activity; sid:2058717; rev:1; metadata:affected_product Android, attack_target Mobile_Client, tls_state TLSDecrypt, created_at 2025_01_02, deployment Perimeter, deployment Internal, deployment SSLDecrypt, malware_family MOONSHINE, performance_impact Low, confidence High, signature_severity Major, tag Earth_Minotaur, updated_at 2025_01_02, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1189, mitre_technique_name Drive_by_Compromise;)