alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Generic Info Stealer - HTTP POST"; flow:established,to_server; http.method; content:"POST"; nocase; http.request_body; content:"|0d 0a|Content-Type|3a| multipart/form-data|3b| boundary|3d|"; nocase; content:"name=|22|id|22 0d 0a|"; nocase; content:"name=|22|upt|22 0d 0a|"; nocase; content:"name=|22|mode|22 0d 0a|"; nocase; content:"name=|22|version|22 0d 0a|"; nocase; content:"name=|22|cpu|22 0d 0a|"; nocase; fast_pattern; content:"name=|22|ram|22 0d 0a|"; nocase; content:"name=|22|os|22 0d 0a|"; nocase; content:"name=|22|user|22 0d 0a|"; nocase; classtype:trojan-activity; sid:2009470; rev:12; metadata:created_at 2010_07_30, confidence Medium, signature_severity Major, updated_at 2024_03_18;)