ET MALWARE NOBELIUM - Cobalt Strike Malleable Profile M1

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"ET MALWARE NOBELIUM - Cobalt Strike Malleable Profile M1";
    flow:established,to_server;
    urilen:>150;
    http.method;
    content:"GET";
    http.uri;
    content:"v1.5472"; endswith; fast_pattern;
    http.content_type;
    content:"text/html"; bsize:9;
    http.header;
    content:"Cache-Control|3a 20|no-cache";
    reference:url,www.sekoia.io/en/nobeliums-envyscout-infection-chain-goes-in-the-registry-targeting-embassies;
    classtype:command-and-control;
    sid:2034868; rev:2;
    metadata:attack_target Client_Endpoint, created_at 2021_12_07, deployment Perimeter, malware_family Cobalt_Strike, confidence Medium, signature_severity Major, updated_at 2021_12_07, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1001, mitre_technique_name Data_Obfuscation;
)