alert http any any -> any any (msg:"BACKDOOR [PTsecurity] Trojan.Backdoor (APT Patchwork)"; flow:established, to_server; http.method; content:"POST"; http.header; content:"Content-Type|3a| application/x-www-form-urlencoded"; content:!"Referer|3a|"; http.request_body; content:"umnome="; depth:7; fast_pattern; content:"&pmjodf="; distance:0; content:"&idkdfjej="; distance:0; content:"&cokenme="; distance:0; reference:url, rules.ptsecurity.com; classtype:trojan-activity; sid:10011589; rev:2;)