alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/24x7Help.ScareWare CnC Beacon"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/api/client.asmx/SendData"; http.user_agent; content:"mFramework HTTPGet"; fast_pattern; http.request_body; content:"CFG="; depth:4; content:"&Lng="; distance:0; content:"&sinst="; distance:0; reference:md5,8d2dec745b9ac380beb2a0ea66427d06; classtype:command-and-control; sid:2019498; rev:4; metadata:attack_target Client_Endpoint, created_at 2014_10_23, deployment Perimeter, signature_severity Major, tag c2, updated_at 2020_05_12, mitre_tactic_id TA0010, mitre_tactic_name Exfiltration, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)