ET MALWARE MacSync Stealer Exfil (PUT)

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"ET MALWARE MacSync Stealer Exfil (PUT)";
    flow:established,to_server;
    http.method;
    content:"PUT";
    http.uri;
    content:"|2f|gate|3f|buildtxd|3d|"; startswith; fast_pattern;
    content:"&upload_id=";
    content:"&chunk_index=";
    content:"&total_chunks";
    http.user_agent;
    content:"Macintosh";
    classtype:command-and-control;
    sid:2069444; rev:1;
    metadata:affected_product Mac_OSX, attack_target Client_Endpoint, tls_state TLSDecrypt, created_at 2026_05_27, deployment Perimeter, deployment SSLDecrypt, malware_family MacSync, confidence High, signature_severity Critical, tag c2, updated_at 2026_05_27, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1071, mitre_technique_name Application_Layer_Protocol;
    target:src_ip;
)