alert http $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Go/Anubis CnC Activity (POST)"; flow:established,to_server; http.request_line; content:"POST /callback HTTP/1.1"; fast_pattern; http.header_names; content:!"Referer"; http.host; pcre:"/^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/"; http.request_body; content:"callback="; startswith; content:"&reginfo="; distance:0; reference:md5,1f21b8e9ebc3b7480cc67ced7504916f; reference:url,medium.com/walmartglobaltech/privateloader-to-anubis-loader-55d066a2653e; classtype:command-and-control; sid:2035185; rev:2; metadata:attack_target Client_Endpoint, created_at 2022_02_14, deployment Perimeter, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2023_03_20;)