alert http any any -> any any (msg:"STEALER [PTsecurity] VenomStealer Data Exfiltration"; flow:established, to_server; http.method; content:"POST"; http.uri; content:"/api/upload"; http.request_body; content:"name=|22|victim_id|22|"; fast_pattern; depth:300; content:"name=|22|computer_name|22|"; content:"name=|22|username|22|"; content:"name=|22|data_type|22|"; content:"name=|22|filename|22|"; http.header; content:!"Accept"; content:!"Referer|3a|"; reference:url, app.any.run/tasks/664e2bdb-ce5b-42a6-a1b5-58dc433101c6; reference:url, rules.ptsecurity.com; classtype:trojan-activity; sid:10016822; rev:1;)