alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Protux.B POST checkin"; flow:from_client,established; http.method; content:"POST"; nocase; http.header; content:"Mozilla/4.8.20 (compatible|3b 20|MSIE 5.0.2|3b 20|Win32)|0d 0a|Host|3a 20|"; reference:md5,53105ecf3cf6040039e16abb382fb836; classtype:command-and-control; sid:2014360; rev:5; metadata:created_at 2012_03_10, malware_family Win32_Protux_B, signature_severity Major, updated_at 2020_04_21;)