alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE [PTsecurity] JS.Trojan-Downloader.Nemucod.yo HTTP POST (:Exec:)"; flow:established, to_server; threshold:type limit, track by_src, count 1, seconds 30; http.request_body; content:"|3a 3a 3a|Exec|3a 3a 3a|http"; depth:40; fast_pattern; content:"|3a|//"; within:4; content:".exe|3a 3a|"; within:100; http.header_names; content:!"Referer|0d 0a|"; classtype:trojan-activity; sid:2024701; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2017_09_12, deployment Internet, malware_family Nemucod, performance_impact Moderate, confidence High, signature_severity Major, updated_at 2020_08_19;)