ET MALWARE Possible Dyre SSL Cert (fake state)

alert tls $EXTERNAL_NET [443,4443] -> $HOME_NET any (
    msg:"ET MALWARE Possible Dyre SSL Cert (fake state)";
    flow:established,to_client;
    tls.cert_serial;
    content:"00:"; startswith; bsize:26;
    tls.cert_subject;
    content:"C=AU"; fast_pattern;
    content:!"ST=Some-State";
    tls.certs;
    content:"|02 09 00|"; distance:8; within:3;
    content:"|06 03 55 04 06 13 02 41 55|"; distance:0;
    content:"|06 03 55 04 08|"; distance:0;
    pcre:"/^.{2}(?=[A-Z]{0,32}[^A-Z01])(?P<var>[^01]{4,33}[01]).+?\x06\x03\x55\x04\x08.{2}(?P=var)/Rs";
    classtype:trojan-activity;
    sid:2019833; rev:11;
    metadata:attack_target Client_Endpoint, created_at 2014_12_02, deployment Perimeter, performance_impact Moderate, confidence Medium, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2022_06_27, reviewed_at 2024_03_25;
)