alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT LightsOut EK POST Compromise POST"; flow:to_server,established; http.method; content:"POST"; http.uri; content:".php?id="; nocase; content:"&v1="; nocase; content:"&v2="; nocase; fast_pattern; content:"&q="; nocase; http.header; content:"Content-Length|3a 20|0"; http.header_names; content:!"Referer|0d 0a|"; content:!"Accept|0d 0a|"; reference:url,blogs.cisco.com/security/watering-hole-attacks-target-energy-sector; classtype:exploit-kit; sid:2017544; rev:4; metadata:created_at 2013_09_30, confidence High, signature_severity Major, updated_at 2020_09_21;)