alert smtp $HOME_NET any -> $EXTERNAL_NET 587 (msg:"🐾 - 🚨 Agent Tesla 👾 SMTP Exfiltration - T1048"; flow:to_server, stateless; content:"|45 48 4c 4f 20|"; content:"|53 75 62 6a 65 63 74 3a 20|"; pcre:"/.{1,}[\/\/]{1}.{1,}/"; distance:0; content:"|54 69 6d 65 3a 20|"; content:"|3c 62 72 3e 55 73 65 72 20 4e 61 6d 65 3a 20|"; content:"|3c 62 72 3e 4f 53 46 75 6c 6c 4e 61 6d 65 3a 20|"; fast_pattern; content:"|51 55 49 54 0d 0a|"; endswith; reference:url,https://attack.mitre.org/techniques/T1048/; reference:url,https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla; target:src_ip; metadata:attack_target Client_and_Server, signature_severity Major, affected_product Windows_XP_Vista_7_8_10_11_Server_32_64_Bit, mitre_tactic_id TA0010, mitre_tactic_name Exfiltration, mitre_technique_id T1048, mitre_technique_name Exfiltration_Over_Alternative_Protocol, malware_family Agent_Tesla, created_at 2024_08_13, updated_at 2024_08_13; sid:3321332; rev:2; classtype:targeted-activity;)