alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Necurs Common POST Header Structure"; flow:established,to_server; urilen:10<>20; http.method; content:"POST"; http.uri; content:".php"; http.user_agent; content:!"NSIS|5f|Inetc |28|Mozilla|29|"; http.host; pcre:"/^(?:\d{1,3}\.){3}\d{1,3}/"; http.request_body; pcre:"/^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]/"; http.connection; content:"keep-alive"; nocase; http.content_type; content:"application/x-www-form-urlencoded"; endswith; http.content_len; byte_test:0,<=,400,0,string,dec; http.header_names; content:"|0d 0a|Content-Type|0d 0a|User-Agent|0d 0a|Host|0d 0a|Content-Length|0d 0a|Connection|0d 0a|"; depth:62; fast_pattern; content:!"Accept"; content:!"Referer"; reference:md5,d11a453d4de6e6fd991967d67947c0d7; classtype:trojan-activity; sid:2021995; rev:6; metadata:created_at 2015_10_23, malware_family Win32_Necurs, performance_impact Moderate, signature_severity Major, updated_at 2024_04_08;)