alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/Dexter Infostealer CnC POST"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"page="; depth:5; content:"&spec="; distance:0; content:"&opt="; distance:0; content:"var="; distance:0; content:"val="; distance:0; reference:url,contagiodump.blogspot.co.uk/2012/12/dexter-pos-infostealer-samples-and.html; classtype:command-and-control; sid:2016095; rev:3; metadata:created_at 2012_12_28, signature_severity Major, updated_at 2020_04_22;)