alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/Alina.POS-Trojan Checkin"; flow:established,to_server; http.method; content:"POST"; http.uri; content:".php"; endswith; http.header; content:"Accept|3a 20|application/octet-stream|0d 0a|Content-Type|3a 20|application/octet-stream|0d 0a|"; depth:74; fast_pattern; http.header_names; content:!"Referer|0d 0a|"; reference:md5,3959fb5b5909d9c6fb9c9a408d35f67a; reference:url,trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp-pos-ram-scraper-malware.pdf; classtype:command-and-control; sid:2021597; rev:5; metadata:created_at 2015_08_05, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_05_29;)