ET MALWARE Possible OceanLotus C2 Checkin

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"ET MALWARE Possible OceanLotus C2 Checkin";
    flow:to_server,established;
    http.method;
    content:"GET";
    http.uri;
    content:".db?k="; fast_pattern;
    content:"?q="; distance:0;
    pcre:"/\?q=[a-f0-9]{32}$/i";
    http.header_names;
    content:!"Accept";
    content:!"Referer|0d 0a|";
    content:!"User-Agent|0d 0a|";
    reference:url,www.alienvault.com/open-threat-exchange/blog/oceanlotus-for-os-x-an-application-bundle-pretending-to-be-an-adobe-flash-update;
    classtype:command-and-control;
    sid:2022541; rev:3;
    metadata:created_at 2016_02_18, confidence Medium, signature_severity Major, updated_at 2020_06_24;
)