ET MALWARE TA577 Style Request (2023-05-15)

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"ET MALWARE TA577 Style Request (2023-05-15)";
    flow:established,to_server;
    flowbits:set,ET.TA557.20230515.Request;
    http.method;
    content:"GET";
    urilen:10<>16;
    http.uri;
    content:"/"; startswith;
    content:"/?9"; offset:3; depth:5; fast_pattern;
    isdataat:!8,relative;
    content:!"|2e|";
    content:!"&";
    pcre:"/^\/(?!(?:h(?:elp|tml)|a(?:ch|ds)|blog|goto|item|site|user|en))(?:[A-IL-VX]{2,4}|[a-il-vx]{2,4})\/\?9[0-9]{4,7}$/";
    http.header_names;
    content:!"|0d 0a|Referer|0d 0a|"; nocase;
    http.host;
    content:!"ebby.com";
    content:!"attsuppliers.com";
    content:!"rittal.com";
    classtype:trojan-activity;
    sid:2048254; rev:3;
    metadata:attack_target Client_and_Server, created_at 2023_09_26, deployment Perimeter, deployment SSLDecrypt, performance_impact Low, confidence Medium, signature_severity Major, tag TA577, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2023_12_13, reviewed_at 2023_09_26;
    target:src_ip;
)