alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Shylock Module Data POST"; flow:established,to_server; http.request_body; content:"id="; content:"&bid="; distance:0; content:"&query="; distance:0; content:"&data="; distance:0; pcre:"/id=\d+&bid=[^&]+&query=\w+&data=\w/"; reference:md5,4fda5e7e8e682870e993f97ad26ba6b2; reference:url,anubis.iseclab.org/index.php?action=result&task_id=86c6da9437e65c94990ddd85d87299f1; classtype:trojan-activity; sid:2013687; rev:5; metadata:created_at 2011_09_22, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_04_22;)