alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32.Downloader Tibs.jy Reporting to C&C"; flow:established,to_server; http.uri; content:"/post.php"; nocase; http.user_agent; content:"Mozilla|2f|3|2e|0b5a|20 28|Win95|7c|3b|7c 20|I|29|"; startswith; nocase; fast_pattern; http.request_body; content:"data="; startswith; nocase; classtype:command-and-control; sid:2003238; rev:9; metadata:created_at 2010_07_30, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_02_06;)