alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"TOOLS [PTsecurity] Empire Request"; flow:established, to_server; content:"POST"; http_method; content:"session="; http_cookie; fast_pattern; content:"="; http_cookie; endswith; http.header; content:"User-Agent: "; depth:100; content:"Host: "; within:400; content:"Content-Length: 462|0d0a|"; within:400; content:!"Referer|3a|"; content:!"Content-Type: "; reference:url, https://www.hybrid-analysis.com/sample/52404b26bb9fe6e27ea3efbcbfd66712d33ab5b7f62c27fb823c430eccb12cb3/?environmentId=100; reference:url, rules.ptsecurity.com; classtype:trojan-activity; sid:10002268; rev:12;)