ET HUNTING Possible Racoon Stealer Retrieving Google Account Details (GET)

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"ET HUNTING Possible Racoon Stealer Retrieving Google Account Details (GET)";
    flow:established,to_server;
    http.method;
    content:"GET";
    http.uri;
    content:"|2f|InteractiveLogin|3f|continue|3d|https|3a 2f 2f|www|2e|youtube|2e|com|2f|getAccountSwitcherEndpoint|26|followup|3d|https|3a 2f 2f|www|2e|youtube|2e|com|2f|getAccountSwitcherEndpoint|26|passive|3d|"; startswith; fast_pattern;
    content:"&service=youtube&";
    http.cookie;
    content:"NID="; startswith;
    content:"OGPC=";
    content:"|3a 3b 20|AEC|3d|A";
    content:"VISITOR_INFO1_LIVE=";
    http.content_type;
    content:"application/json";
    http.host;
    content:"accounts.google.com";
    reference:md5,084f0d74d04cbec4287b39b7a2d0b89f;
    reference:url,twitter.com/Gi7w0rm/status/1641488122302148635;
    classtype:misc-activity;
    sid:2044835; rev:1;
    metadata:attack_target Client_Endpoint, created_at 2023_03_30, deployment Perimeter, deployment SSLDecrypt, malware_family Raccoon_Stealer, performance_impact Moderate, confidence Medium, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2023_03_30;
)