alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO URL Contains passwd Parameter"; flow:established,to_server; http.uri; content:"passwd="; nocase; pcre:"/(?<=(\?|&))passwd=(?!&)/i"; classtype:policy-violation; sid:2012912; rev:3; metadata:created_at 2011_06_01, confidence High, signature_severity Informational, updated_at 2024_03_15;)