alert http any any -> any any (msg:"TGI HUNT unknown command 610cker"; flow:to_server,established; content:"POST"; http_method; content:"/command.php"; http_uri; content:"cmd="; http_client_body; depth:4; threshold:type limit, track by_src, seconds 60, count 1; classtype:bad-unknown; sid:2610278; rev:1;)