alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET COINMINER Bitcoin Mining Extensions Header"; flow:established,to_server; http.method; content:"POST"; http.header_names; to_lowercase; content:"|0d 0a|x-mining-extensions|0d 0a|"; fast_pattern; classtype:coin-mining; sid:2016758; rev:7; metadata:created_at 2013_04_16, signature_severity Minor, updated_at 2024_05_06;)