alert http $HOME_NET any -> $EXTERNAL_NET any (
msg:"ET INFO Bluetrait RMM Heartbeat Check-in Observed";
flow:established,to_server;
flowbits:set,ET.Bluetrait.Heartbeat.Checkin;
http.method;
content:"POST";
http.uri; bsize:5;
content:"/api/";
http.host;
content:"bluetrait.io"; fast_pattern; endswith;
http.request_body;
content:"|7b 22|api_action|22 3a 22|msp|22 2c 22|api_version|22 3a 22|"; startswith;
content:"|22 2c 22|task|22 3a 22|checkin|22 2c 22|uuid|22 3a 22|"; within:40;
pcre:"/^[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}/R";
content:"|22 2c 22|data|22 3a 22 7b 5c 22|name|5c 22 3a 5c 22|"; within:80;
reference:url,bluetrait.io;
classtype:misc-activity;
sid:2057027; rev:1;
metadata:affected_product Bluetrait_RMM, attack_target Client_Endpoint, tls_state TLSDecrypt, created_at 2024_10_23, deployment Perimeter, deployment Internal, deployment SSLDecrypt, performance_impact Low, confidence High, signature_severity Informational, updated_at 2024_10_23;
target:src_ip;
)