alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/PSW.Papras.CK file upload"; flow:established,to_server; http.method; content:"POST"; http.uri; pcre:"/^\x2f[a-zA-Z]{4,}\x2ephp\x3f[a-zA-Z]{2,10}\x3d(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})+/"; http.request_body; content:"name|3d 22|upload_file|22 3b 20|filename|3d 22|"; fast_pattern; reference:md5,5e7cbe7e62a6c5de45092ad0c4852d1a; reference:url,csis.dk/en/csis/news/4472/; classtype:trojan-activity; sid:2019379; rev:4; metadata:created_at 2014_10_09, malware_family Win32_PSW_Papras_CK, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_05_12;)