alert http $HOME_NET any -> $EXTERNAL_NET 82 (msg:"ET MALWARE LD Pinch Checkin (HTTP POST on port 82)"; flow:established,to_server; content:"POST"; nocase; http_method; content:".php"; content:"a="; content:"&b="; content:"&d="; content:"&c="; nocase; classtype:command-and-control; sid:2008366; rev:4; metadata:created_at 2010_07_30, signature_severity Major, updated_at 2019_07_26;)