IDS Signature to detect the extraneous space in Cobalt Strike < 3.13

cobaltstrike-extraspace.rules

alert tcp any any -> any any (msg:"FOX-IT - Trojan - Possible CobaltStrike C2 Server"; \
    flow:to_client; \
    content:"HTTP/1.1 200 OK |0d0a|"; fast_pattern; depth:18; \
    content:"Date: "; \
    pcre:"/^HTTP/1.1 200 OK \r\nContent-Type: [^\r\n]{0,100}\r\nDate: [^\r\n]{0,100} GMT\r\n(Content-Length: \d+\r\n)\r\n/"; \
    threshold:type limit, track by_dst, count 1, seconds 600; \
    classtype:trojan-activity; priority:2; \
    sid:21002217; rev:3;)

Full blog post here: https://blog.fox-it.com/2019/02/26/identifying-cobalt-strike-team-servers-in-the-wild/