alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Zeus Checkin Header Pattern"; flow:established,to_server; content:"POST"; nocase; http_method; content:"HTTP/1.1|0d 0a|Accept|3a 20|*/*|0d 0a|X-ID|3a 20|"; fast_pattern; pcre:"/^X-ID\x3a\x20\d+\r?$/Hm"; classtype:command-and-control; sid:2014014; rev:7; metadata:created_at 2011_12_09, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2022_03_17;)