ET MALWARE Suspected APT LuckyMouse BlueTraveller CnC

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"ET MALWARE Suspected APT LuckyMouse BlueTraveller CnC";
    flow:established,to_server;
    http.method;
    content:"GET";
    http.uri;
    content:"/home/"; startswith;
    pcre:"/^[0-9]{4}\/[0-9]{4}\/[^\r\n]+(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$/R";
    http.header_names;
    content:"|0d 0a|User-Agent|0d 0a|Host|0d 0a|Cache-Control|0d 0a|"; startswith; fast_pattern;
    content:!"Referer";
    content:!"Accept";
    pcre:"/Cache-Control\r\n(?:\r\n|Cookie\r\n\r\n)$/";
    reference:url,decoded.avast.io/luigicamastra/apt-group-targeting-governmental-agencies-in-east-asia/;
    classtype:command-and-control;
    sid:2031316; rev:2;
    metadata:attack_target Client_Endpoint, created_at 2020_12_11, deployment Perimeter, malware_family apt27, malware_family luckymouse, performance_impact Moderate, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_12_22;
)