ET MALWARE Win32/Plugx CnC Activity (CONNECT)

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"ET MALWARE Win32/Plugx CnC Activity (CONNECT)";
    flow:to_server,established;
    http.method;
    content:"CONNECT";
    http.uri;
    content:"/update?id="; startswith; fast_pattern;
    http.user_agent;
    content:"Mozilla|2f|4|2e|0|20 28|compatible|3b 20|MSIE|20|"; bsize:30;
    http.content_len;
    content:"0"; bsize:1;
    http.content_type;
    content:"text/html";
    http.header;
    content:"Proxy|2d|Connection|3a 20|Keep|2d|Alive";
    content:"Proxy|2d|Authorization|3a 20|Basic|20|";
    reference:url,twitter.com/StopMalvertisin/status/1628426658956075011;
    reference:md5,e832281f64504e3dce46860b605116a9;
    classtype:trojan-activity;
    sid:2044311; rev:2;
    metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2023_02_23, deployment Perimeter, malware_family Win32_PlugX, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2023_02_23, reviewed_at 2023_11_17;
)