alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/Alina.POS-Trojan Checkin"; flow:established,to_server; http.method; content:"POST"; http.uri; content:".php"; endswith; http.accept; content:"application/octet-stream"; bsize:24; fast_pattern; http.user_agent; content:"Mozilla/"; startswith; content:"|20|InfoPath|2e|"; distance:0; pcre:"/x20InfoPath\x2e\d[^\x29]+$/i"; http.header_names; content:!"Referer|0d 0a|"; reference:md5,3959fb5b5909d9c6fb9c9a408d35f67a; reference:url,trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp-pos-ram-scraper-malware.pdf; classtype:command-and-control; sid:2019163; rev:4; metadata:created_at 2014_09_11, signature_severity Major, updated_at 2020_05_29;)