alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE LuckyCat/TROJ_WIMMIE Checkin"; flow:established,to_server; http.method; content:"POST"; nocase; http.uri; content:".php?m="; content:"&n="; within:4; content:"_"; distance:0; content:"@"; distance:0; pcre:"/\.php\?m=\w&n=\w+_\w+(@|@.c|@.t)$/"; reference:url,blog.trendmicro.com/luckycat-redux-inside-an-apt-campaign/; reference:url,trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp_luckycat_redux.pdf; classtype:command-and-control; sid:2014462; rev:4; metadata:created_at 2012_04_04, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_04_21;)