ET MALWARE NOBELIUM - Cobalt Strike Malleable Profile M2

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"ET MALWARE NOBELIUM - Cobalt Strike Malleable Profile M2";
    flow:established,to_server;
    http.method;
    content:"GET";
    http.cookie; bsize:>170;
    content:".html"; endswith; fast_pattern;
    http.content_type;
    content:"text/html"; bsize:9;
    http.header;
    content:"Cache-Control|3a 20|no-cache";
    reference:url,www.sekoia.io/en/nobeliums-envyscout-infection-chain-goes-in-the-registry-targeting-embassies;
    classtype:command-and-control;
    sid:2035216; rev:2;
    metadata:attack_target Client_Endpoint, created_at 2022_02_18, performance_impact Significant, confidence Medium, signature_severity Major, updated_at 2024_04_30;
)