# Tracemap checkin
**URL:** https://community.emergingthreats.net/t/tracemap-checkin/569
**Category:** Rule Signatures
**Created:** [May 18, 2023, 1:27pm UTC](https://community.emergingthreats.net/t/tracemap-checkin/569 "2023-05-18T13:27:22Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@NoahWolf](https://community.emergingthreats.net/u/NoahWolf)
#### Post date: [May 18, 2023, 1:27pm UTC](https://community.emergingthreats.net/t/tracemap-checkin/569/1 "2023-05-18T13:27:22Z")
Found this malware on ANY.RUN. Here is the signature,
`alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"tracemap checkin"; http.method; content:"GET"; http.uri; content:"/api/traceman.php"; reference:url,https://app.any.run/tasks/ae8b24fa-5f95-4535-a2fd-e2d434dd927c/; sid:2008009; rev:1;)`
---
### Author:  [@jtaylor](https://community.emergingthreats.net/u/jtaylor)
#### Post date: [May 19, 2023, 11:10am UTC](https://community.emergingthreats.net/t/tracemap-checkin/569/2 "2023-05-19T11:10:31Z")
Thanks for the submission! We will take a look and see about getting it in for todays release.
JT
---
### Author:  [@jtaylor](https://community.emergingthreats.net/u/jtaylor)
#### Post date: [May 19, 2023, 11:42am UTC](https://community.emergingthreats.net/t/tracemap-checkin/569/3 "2023-05-19T11:42:35Z")
> [@NoahWolf](#):
>
> [Analysis File\_pass1234.7z (MD5: 6323683CD9D1A9B15963CF5F50445139) Malicious activity - Interactive analysis ANY.RUN](https://app.any.run/tasks/ae8b24fa-5f95-4535-a2fd-e2d434dd927c/)
It looks like we have a PRO sig 2852977 - ETPRO Win32/BeamWinHTTP CnC Activity M2 (GET) that covers this activity and close to what you have suggested. We will be moving that to the OPEN set today.