alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED WIN32/KOVTER.B Checkin"; flow:established,to_server; http.method; content:"POST"; http.uri; content:".php"; endswith; http.user_agent; content:!"DoPost"; nocase; http.host; content:!".foxitservice.com"; http.content_len; byte_test:0,<,1000,0,string,dec; http.content_type; content:"application/x-www-form-urlencoded"; bsize:33; http.header_names; content:"|0d 0a|Content-Type|0d 0a|User-Agent|0d 0a|Host|0d 0a|Content-Length|0d 0a|"; startswith; fast_pattern; content:!"Referer"; content:!"Accept"; http.request_body; pcre:"/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$/"; reference:md5,7943a103d7b79f87843655e6b2f8e80c; classtype:command-and-control; sid:2020181; rev:13; metadata:created_at 2015_01_15, performance_impact Significant, signature_severity Unknown, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2022_08_30;)