alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Neverquest Request URI Struct"; flow:established,to_server; http.method; content:"POST"; http.uri; content:".php?sid="; fast_pattern; pcre:"/\/\d\.php\?sid=[0-9A-F]{32}$/"; http.header_names; content:!"Referer|0d 0a|"; classtype:trojan-activity; sid:2019384; rev:5; metadata:created_at 2014_10_10, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_09_25;)