Darkrat yara snort suricata

rule Darkrat_bin
{
    meta:
        description = "Darkrat"
        author = "James_inthe_box"
        reference = "https://github.com/albertzsigovits/malware-writeups/tree/master/DarkRATv2"
        date = "2019/08"
        maltype = "RAT"

    strings:
        $string1 = "Set objShell = WScript.CreateObject(\"WScript.Shell\")"
        $string2 = "&taskstatus="
        $string3 = "network reset"
        $string4 = "text/plain"
        $string5 = "&antivirus="
        $string6 = "request="
        $string7 = "&arch="

    condition:
        uint16(0) == 0x5A4D and all of ($string*) and filesize < 600KB
}

rule Darkrat_mem
{
    meta:
        description = "Darkrat"
        author = "James_inthe_box"
        reference = "https://github.com/albertzsigovits/malware-writeups/tree/master/DarkRATv2"
        date = "2019/08"
        maltype = "RAT"

    strings:
        $string1 = "Set objShell = WScript.CreateObject(\"WScript.Shell\")"
        $string2 = "&taskstatus="
        $string3 = "network reset"
        $string4 = "text/plain"
        $string5 = "&antivirus="
        $string6 = "request="
        $string7 = "&arch="

    condition:
        all of ($string*) and filesize > 600KB
}

snort / suricata
alert tcp any any -> any $HTTP_PORTS (msg:"Darkrat Initial Request"; flow:to_server,established; content:"POST"; http_method; content:"request"; http_uri; content:"request="; http_client_body; reference:url,github.com/albertzsigovits/malware-writeups/tree/master/DarkRATv2; classtype:trojan-activity; sid:20166304; rev:1; metadata:created_at 2019_08_15;)