alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Trojan.Dirtjump Checkin"; flow:established,to_server; http.method; content:"POST"; nocase; http.request_body; content:"req="; depth:4; pcre:"/^[A-Za-z0-9]{15}(?:[A-Za-z0-9]{19})?$/R"; reference:url,www.arbornetworks.com/asert/2013/08/dirtjumper-drive-shifts-into-a-new-gear/; reference:md5,50a538221e015d77cf4794ae78978ce2; classtype:command-and-control; sid:2017385; rev:3; metadata:created_at 2013_08_28, signature_severity Major, updated_at 2020_04_24;)