alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Cloudflare API Zone List Request (GET)"; flow:established,to_server; http.method; content:"GET"; http.uri; bsize:16; content:"/client/v4/zones"; fast_pattern; http.host; bsize:18; content:"api.cloudflare.com"; threshold:type limit,count 1,seconds 300,track by_src; classtype:unknown; sid:2069383; rev:3; metadata:attack_target Client_Endpoint, tls_state TLSDecrypt, created_at 2026_05_20, deployment Perimeter, deployment SSLDecrypt, confidence Medium, signature_severity Informational, updated_at 2026_05_20, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities; target:src_ip;)