ET MALWARE OceanLotus System Profiling JavaScript HTTP Request

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"ET MALWARE OceanLotus System Profiling JavaScript HTTP Request";
    flow:established,to_server;
    http.uri;
    content:".jpg?v="; fast_pattern;
    content:"&d="; distance:0;
    pcre:"/\.jpg\?v=\d+&d=(?!\d{8}T\d{6}Z)(?:[A-Za-z0-9+\/]{4})*(?:[A-Za-z0-9+\/]{2}==|[A-Za-z0-9+\/]{3}=|[A-Za-z0-9+\/]{4})$/";
    http.host;
    content:!"c.shld.net";
    content:!"scholtzskys.com";
    reference:url,www.volexity.com/blog/2017/11/06/oceanlotus-blossoms-mass-digital-surveillance-and-exploitation-of-asean-nations-the-media-human-rights-and-civil-society/;
    classtype:targeted-activity;
    sid:2024969; rev:5;
    metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2017_11_07, deployment Perimeter, performance_impact Low, confidence High, signature_severity Critical, tag OceanLotus, updated_at 2020_08_31;
)