alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/Nymaim Checkin M2"; flow:established,to_server; http.method; content:"POST"; http.content_type; bsize:33; content:"application/x-www-form-urlencoded"; nocase; http.user_agent; content:"|20|MSIE|20|"; http.request_body; content:"filename="; startswith; fast_pattern; content:"&data="; distance:0; pcre:"/^filename=[a-z]+?\.[a-z]+?&data=/"; http.header_names; to_lowercase; content:!"|0d 0a|referer|0d 0a|"; classtype:command-and-control; sid:2016757; rev:15; metadata:created_at 2013_04_16, signature_severity Major, updated_at 2024_05_04;)