ET MALWARE SiameseKitten/Lyceum/Hexane MSIL/Shark CnC Checkin

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"ET MALWARE SiameseKitten/Lyceum/Hexane MSIL/Shark CnC Checkin";
    flow:established,to_server;
    http.method;
    content:"GET";
    http.uri;
    content:"?q=";
    content:"&qi="; distance:0;
    content:"&q1="; distance:0;
    content:"&q2="; distance:0;
    content:"&q3="; distance:0;
    pcre:"/^(?:[A-Z0-9+/]{4})*(?:[A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})/R";
    http.user_agent;
    content:"|28|Windows|20|NT|20|10.0|3b 20|Win64|3b 20|x64|29|";
    http.header_names;
    content:"If-None-Match|0d 0a|Sec-Fetch-Dest|0d 0a|Sec-Fetch-Mode|0d 0a|Sec-Fetch-User|0d 0a|"; nocase;
    http.header;
    content:"Sec-Fetch-Dest|3a 20|document|0d|"; fast_pattern;
    reference:url,www.accenture.com/us-en/blogs/cyber-defense/iran-based-lyceum-campaigns;
    reference:url,www.clearskysec.com/siamesekitten/;
    classtype:command-and-control;
    sid:2033760; rev:2;
    metadata:created_at 2021_08_22, malware_family Shark, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2021_09_08;
)