alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE MassLogger Client Exfil (POST) M3"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/?/upload"; endswith; fast_pattern; http.content_type; content:"application/json"; bsize:16; http.request_body; content:"{|22|ID|22 3a 22|"; startswith; content:"|22 2c 22|User|22 3a 22|"; content:"|22 2c 22|Country|22 3a 22|"; content:"|22 2c 22|Date|22 3a 22|"; content:"|22 2c 22|Image|22 3a|"; http.header_names; content:!"User-Agent"; content:!"Referer"; content:!"Accept"; reference:url,twitter.com/James_inthe_box/status/1305509852362338304; reference:url,app.any.run/tasks/010a8af5-97bd-4e27-961d-8d202a9d6f29/; reference:md5,0a838f0ecff085eb611e41acf78a9682; classtype:trojan-activity; sid:2030878; rev:2; metadata:attack_target Client_Endpoint, created_at 2020_09_14, deployment Perimeter, performance_impact Low, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_10_22;)