ET MALWARE Turla APT/Kazuar Backdoor CnC Activity (POST)

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"ET MALWARE Turla APT/Kazuar Backdoor CnC Activity (POST)";
    flow:established,to_server;
    http.method;
    content:"POST";
    http.uri;
    content:".php"; endswith;
    http.cookie;
    content:"AspNet.Cookies=MTY5NzM5ZTcyMTEyOTUxNDZhNjFkMzAwYzBmZWYwMmQ="; bsize:59; fast_pattern;
    http.request_body;
    content:"|3c|"; depth:1;
    content:"|3e 3c|";
    reference:url,community.emergingthreats.net/t/new-sig-et-trojan-w32-kazuar-backdoor-turla-apt-hardcoded-cookie/1136;
    reference:url,unit42.paloaltonetworks.com/pensive-ursa-uses-upgraded-kazuar-backdoor;
    classtype:trojan-activity;
    sid:2049264; rev:1;
    metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2023_11_20, deployment Perimeter, confidence High, signature_severity Critical, tag Turla, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2023_11_20;
)