ET MALWARE nspx30 Orchestrator CnC Checkin

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"ET MALWARE nspx30 Orchestrator CnC Checkin";
    flow:established,to_server;
    http.method;
    content:"GET";
    http.uri;
    content:"/id|3d|"; startswith;
    pcre:"/^[a-f0-9]{32}/R";
    content:"ad|3d|";
    pcre:"/^\d{2}/R";
    content:"os|3d|";
    pcre:"/^\d{1,3}\x2e\d{1,3}/R";
    content:"t|3d|";
    pcre:"/^\d/R";
    http.host;
    content:"www.baidu.com";
    http.user_agent;
    content:"Mozilla/4.0 |28|compatible|3b|MSIE 5.0|3b 20|Windows 98|29|";
    reference:url,www.welivesecurity.com/en/eset-research/nspx30-sophisticated-aitm-enabled-implant-evolving-since-2005/;
    classtype:trojan-activity;
    sid:2050498; rev:1;
    metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, affected_product Windows_11, attack_target Client_Endpoint, created_at 2024_01_25, deployment Perimeter, performance_impact Low, confidence High, signature_severity Major, updated_at 2024_01_25;
    target:src_ip;
)