alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious POST Format"; flow:established,to_server; http.method; content:"POST"; http.request_line; content:"/upload/upload.asp HTTP/1.0"; fast_pattern; http.content_type; content:"application/x-www-form-urlencoded"; bsize:33; reference:url,norfolkinfosec.com/dprk-malware-targeting-security-researchers/; reference:url,blog.google/threat-analysis-group/new-campaign-targeting-security-researchers/; classtype:bad-unknown; sid:2031560; rev:1; metadata:created_at 2021_01_26, confidence Medium, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2021_01_26;)