alert http1 $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO LoJack asset recovery/tracking - not malicious"; flow:established,to_server; urilen:1; http.method; content:"POST"; http.header_names; content:"|0d 0a|TagId|0d 0a|"; fast_pattern; http.host; content:".namequery.com"; endswith; threshold:type limit, count 2, seconds 300, track by_src; reference:url,www.absolute.com/en/lojackforlaptops/home.aspx; classtype:attempted-recon; sid:2012689; rev:8; metadata:created_at 2011_04_15, confidence High, signature_severity Informational, updated_at 2024_04_09;)