ET MALWARE Win32/IcedID Requesting Encoded Binary M5

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"ET MALWARE Win32/IcedID Requesting Encoded Binary M5";
    flow:established,to_server;
    http.method;
    content:"GET";
    http.start;
    content:"HTTP/1.1|0d 0a|Connection|3a 20|Keep-Alive|0d 0a|Cookie|3a 20|__io_r="; fast_pattern;
    http.cookie;
    content:"__io_r="; startswith;
    content:"|3b 20|__io_vl="; distance:0;
    content:"|3b 20|__io_bl="; distance:0;
    content:"|3b 20|Session_id="; distance:0;
    content:"|3b 20|__io_uniq="; distance:0;
    content:"|3b 20|__io_f=";
    isdataat:!38,relative;
    pcre:"/^__io_r=[0-9]{10}_[01]_[0-9]{4,5}_[0-9]{7,8}_[0-9]{1,2}\x3b\x20__io_vl=[0-9]_[0-9]{6}_[0-9]{3}_[0-9]{2}\x3b\x20__io_bl=[0-9]{1,2}:[0-9]:[0-9]{4,5}:[0-9]{2}\x3b\x20Session_id=[0-9A-F]{12}\x3b\x20__io_uniq=[0-9A-F]{8,22}_[0-9A-F]{12,20}\x3b\x20__io_f=[0-9]{2}::[0-9]{10}::[0-9]{9,10}::[0-9]{9,10}$/";
    http.header_names; bsize:30;
    content:"|0d 0a|Connection|0d 0a|Cookie|0d 0a|Host|0d 0a 0d 0a|";
    classtype:command-and-control;
    sid:2031298; rev:3;
    metadata:attack_target Client_Endpoint, created_at 2020_12_08, deployment Perimeter, deployment SSLDecrypt, malware_family IcedID, performance_impact Moderate, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_12_18;
)