alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Vawtrak/NeverQuest Posting Data"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/0"; content:"0000"; distance:1; within:4; fast_pattern; pcre:"/0[0-2]0000[a-fA-F0-9]{16,}$/"; http.header; content:"Content-Type|3a 20|application/octet-stream|0d 0a|User-Agent"; http.header_names; content:!"Referer|0d 0a|"; classtype:trojan-activity; sid:2019501; rev:4; metadata:created_at 2014_10_24, deprecation_reason Performance, performance_impact Significant, signature_severity Major, updated_at 2024_04_08;)