alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Potao CnC"; flow:to_server,established; http.method; content:"POST"; http.request_body; content:"<?xml version=|22|1.0|22|?>"; depth:21; content:"10a7d030-1a61-11e3-beea-001c42e2a08b"; distance:24; fast_pattern; http.content_type; content:"application/xml"; classtype:command-and-control; sid:2021554; rev:4; metadata:created_at 2015_07_31, signature_severity Major, updated_at 2020_10_28;)