alert http $HOME_NET any -> $EXTERNAL_NET 80 (msg:"SPYWARE [PTsecurity] Buhtrap"; flow:established, to_server; content:"POST"; http_method; content:".php"; http_uri; content:"Content-Type: multipart/form-data|3b| boundary="; http_header; pcre:"/^[0-9a-f]{12}\r\n/RH"; content:"Content-Type: application/octet-stream"; http_client_body; content:"Content-Disposition: form-data|3b| name=|22|"; http_client_body; pcre:"/^[a-z]{8,14}\x22\r\nContent-Type: application/octet-stream\r\n\r\n(.{192}){1,2}\r\n--[0-9a-z]{12}--/RPs"; pcre:"/[\x0e-\x19\x80-\xff]{4}/P"; reference:url, rules.ptsecurity.com; classtype:trojan-activity; sid:10003298; rev:4;)