alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/DarkWatchman Activity (POST)"; flow:established,to_server; http.request_line; content:"POST /index.php HTTP/1.1"; fast_pattern; http.header; content:"|0d 0a|X-Client-Id|3a 20|"; pcre:"/^[a-z0-9]{8}\r\n/R"; http.header_names; content:!"Referer"; http.user_agent; content:"Mozilla/5.0(Windows NT|20|"; startswith; threshold:type limit, count 1, seconds 60, track by_src; reference:md5,2ccc9637823753de9cdcdf76a1d22725; classtype:trojan-activity; sid:2035186; rev:3; metadata:attack_target Client_Endpoint, created_at 2022_02_14, deployment Perimeter, deployment SSLDecrypt, malware_family Win32_DarkWatchman, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2023_05_15, reviewed_at 2023_09_12;)