alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET POLICY LoJack asset recovery/tracking - not malicious"; flow:established,to_server; urilen:1; http.method; content:"POST"; http.header_names; content:"|0d 0a|TagId|0d 0a|"; fast_pattern; http.host; content:".namequery.com"; endswith; threshold:type limit, count 2, seconds 300, track by_src; reference:url,www.absolute.com/en/lojackforlaptops/home.aspx; classtype:attempted-recon; sid:2012689; rev:7; metadata:created_at 2011_04_15, confidence High, signature_severity Informational, updated_at 2024_02_22;)