ET MALWARE DonotGroup Maldoc Activity (GET)

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"ET MALWARE DonotGroup Maldoc Activity (GET)";
    flow:established,to_server;
    http.method;
    content:"GET";
    http.uri;
    pcre:"/^\/[A-Za-z0-9]{16}\/[A-Za-z0-9]{16}\.php$/";
    content:"/"; startswith;
    content:"/"; distance:16; within:1;
    content:".php"; distance:16; within:4; endswith;
    http.user_agent;
    content:"|3b 20|ms-office|3b 20|";
    http.header_names;
    content:"|0d 0a|Accept|0d 0a|User-Agent|0d 0a|Accept-Encoding|0d 0a|Host|0d 0a|Connection|0d 0a 0d 0a|"; bsize:59; fast_pattern;
    reference:md5,5c45a038846aea315595b97b0a619f1a;
    reference:url,twitter.com/ShadowChasing1/status/1463498326481932289;
    reference:md5,67abe8b04f62eb55b6b880668fb8a634;
    classtype:trojan-activity;
    sid:2034545; rev:2;
    metadata:attack_target Client_Endpoint, created_at 2021_11_24, deployment Perimeter, malware_family DonotGroup, performance_impact Moderate, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2022_06_27;
)