alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED SpyEyeV1.3.48 Data Post to CnC - lol.php"; flow:established,to_server; content:"POST"; nocase; http_method; content:"/lol.php"; http_uri; content:"data="; depth:5; http_client_body; reference:url,blogs.mcafee.com/mcafee-labs/latest-spyeye-botnet-active-and-cheaper; classtype:command-and-control; sid:2014669; rev:4; metadata:created_at 2012_05_02, signature_severity Unknown, updated_at 2019_07_26;)