alert http1 $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Trojan.Spy.YEK MAC and IP POST"; flow:established,to_server; http.method; content:"POST"; nocase; http.header; content:"Content-Disposition|3a 20|form-data|3b 20|name=|22|MAC|22|"; fast_pattern; nocase; content:"Content-Disposition|3a 20|form-data|3b 20|name=|22|IP|22|"; nocase; reference:url,www.shadowserver.org/wiki/pmwiki.php/Calendar/20101115; classtype:trojan-activity; sid:2011999; rev:9; metadata:created_at 2010_12_07, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_04_09;)