alert http any any -> any any (msg:"BACKDOOR [PTsecurity] RustyNet (APT Patchwork)"; flow:established, to_server; http.method; content:"POST"; http.uri; content:".php"; endswith; http.header; content:"Content-Type: application/x-www-form-urlencoded"; content:"Expect: 100-continue"; content:!"Referer"; http.request_body; content:"simpleid="; depth:9; fast_pattern; content:"&fiiir="; distance:0; content:"&uqid="; distance:0; reference:url, rules.ptsecurity.com; classtype:trojan-activity; sid:10011588; rev:1;)