alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Cridex Post to CnC"; flow:established,to_server; http.method; content:"POST"; http.uri; content:!"."; http.host; content:!"hbi-ingest.net"; http.request_body; content:"|de ad be ef|"; fast_pattern; startswith; reference:url,vrt-blog.snort.org/2012/07/banking-trojan-spread-via-ups-phish.html; reference:url,www.virustotal.com/file/00bf5b6f32b6a8223b8e55055800ef7870f8acaed334cb12484e44489b2ace24/analysis/; reference:url,www.packetninjas.net; classtype:command-and-control; sid:2015028; rev:9; metadata:created_at 2012_07_06, signature_severity Major, updated_at 2024_04_08;)