alert http $HOME_NET any -> $EXTERNAL_NET [80, 443] ( msg:"Bitisight MALWARE StealC DLL"; flow:to_server,established; content:"GET";http_method; pcre:"/^\/[a-f0-9]{16}(?:[a-f0-9]{4})?\/(msvcp140|nss3|softokn3|freebl|vcruntime140|mozglue|sqlite3)\.dll$/U"; sid:2261307656; )
alert http $HOME_NET any -> $EXTERNAL_NET [80, 443] ( msg:"Bitisight MALWARE StealC C2"; flow:to_server,established; content:"POST";http_method; content:"Connection|3a 20|Keep-Alive";http_header; content:"Cache-Control|3a 20|no-cache";http_header; pcre:"/^\/[a-f0-9]{16}(?:[a-f0-9]{4})?\.php$/U"; content:!"User-Agent|3a|"; sid:3082112804; )