alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE vSkimmer.PoS Checkin"; flow:to_server,established; http.uri; content:"/process.php?xy="; fast_pattern; http.header_names; content:!"Accept"; content:!"Connection|0d 0a|"; content:!"Referer|0d 0a|"; reference:md5,a99d5d1652dfcda190c3d412828dcf6d; reference:md5,82d9cab2692ae13fc5b835ea2cbb36d7; reference:url,anubis.iseclab.org/action=result&task_id=1b92f08cdbfb73e64450fd07ec88849b3; classtype:command-and-control; sid:2018109; rev:6; metadata:created_at 2013_03_12, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_09_25;)