content:!"Cookie:"; threshold: type limit, track by_src, count 1, seconds 600; classtype:trojanactivity; reference:url,blog.fox-it.com/2016/06/15/mofang-a-politically-motivated-informationstealing-adversary/; sid:21001855; rev:4;)