alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO Possible Rogue LoJack Asset Tracking Agent"; flow:established,to_server; urilen:1; threshold:type limit, count 2, seconds 300, track by_src; http.method; content:"POST"; http.header_names; content:"|0d 0a|TagId|0d 0a|"; fast_pattern; http.host; content:!".namequery.com"; reference:url,web.archive.org/web/20181003233200/https://asert.arbornetworks.com/lojack-becomes-a-double-agent/; reference:url,www.blackhat.com/docs/us-14/materials/us-14-Kamluk-Computrace-Backdoor-Revisited-WP.pdf; classtype:misc-activity; sid:2025553; rev:5; metadata:attack_target Client_Endpoint, created_at 2018_05_02, deployment Perimeter, confidence Medium, signature_severity Informational, updated_at 2023_04_28;)