alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Neurevt.A/Betabot checkin"; flow:established,to_server; http.method; content:"POST"; nocase; http.request_body; content:"ps0="; depth:4; fast_pattern; content:"&ps1="; pcre:"/^ps0=[A-F0-9]+\&ps1=[A-F0-9]+($|\&[a-z]s\d=)/"; http.header_names; content:!"Referer|0d 0a|"; reference:md5,c447d364a9dad369ff07dcc14f5fbefb; reference:md5,a0a66dfbdf1ce76782ba20a07a052976; classtype:command-and-control; sid:2017371; rev:13; metadata:created_at 2013_05_16, deprecation_reason Age, malware_family Win32_Neurevt_A_Betabot, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_01_30, reviewed_at 2024_01_30;)