alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT XXL-Job RCE"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/run"; http.request_body; content:"GLUE_SHELL"; nocase; fast_pattern; content:"glueSource"; nocase; content:"glueUpdatetime"; nocase; reference:url,github.com/jas502n/xxl-job; reference:url,blogs.juniper.net/en-us/threat-research/sysrv-botnet-expands-and-gains-persistence; classtype:attempted-admin; sid:2033115; rev:1; metadata:attack_target Client_Endpoint, created_at 2021_06_08, deployment Perimeter, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2021_06_08;)