alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Vawtrak/NeverQuest Posting Data"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"=0"; content:"=0000"; distance:3; fast_pattern; pcre:"/=0[0-2](?:&\w+=[a-fA-F0-9]{8}){2}&\w+=[a-fA-F0-9]+$/"; http.header; content:"Content-Type|3a 20|application/octet-stream|0d 0a|User-Agent"; http.header_names; content:!"Referer|0d 0a|"; classtype:trojan-activity; sid:2019500; rev:4; metadata:created_at 2014_10_24, deprecation_reason Performance, performance_impact Significant, signature_severity Major, updated_at 2024_04_08;)