alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Successful Vanguard Phish Mar 06 2017"; flow:to_server,established; content:"POST"; http_method; content:"dmform-0="; depth:9; nocase; http_client_body; content:"&label-dmform-0=User+name"; nocase; distance:0; http_client_body; content:"&label-dmform-1=Password"; nocase; distance:0; http_client_body; content:"&label-dmform-8=Account+Email"; nocase; distance:0; http_client_body; content:"&label-dmform-9=Password"; nocase; distance:0; http_client_body; content:"&dmformsubject=Vang"; nocase; distance:0; http_client_body; fast_pattern; classtype:credential-theft; sid:2024032; rev:3; metadata:created_at 2017_03_06, signature_severity Unknown, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2019_09_06;)