ET MALWARE OSX/WireLurker Checkin

#alert http $HOME_NET any -> $EXTERNAL_NET any (
#    msg:"ET MALWARE OSX/WireLurker Checkin";
#    flow:established,to_server;
#    flowbits:set,ET.WireLurkerUA;
#    http.method;
#    content:"GET";
#    http.uri;
#    content:"/mac_log/?appid="; fast_pattern;
#    http.header_names;
#    content:!"Referer|0d 0a|";
#    reference:url,paloaltonetworks.com/content/dam/paloaltonetworks-com/en_US/assets/pdf/reports/Unit_42/unit42-wirelurker.pdf;
#    classtype:command-and-control;
#    sid:2019661; rev:5;
#    metadata:created_at 2014_11_06, malware_family OSX_WireLurker, signature_severity Major, updated_at 2020_09_28;
#)