alert http1 $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT LightsOut EK POST Compromise POST"; flow:established,to_server; http.method; content:"POST"; http.uri; content:".php?id="; nocase; content:"&v1="; nocase; content:"&v2="; nocase; fast_pattern; content:"&q="; nocase; http.header; content:"Content-Length|3a 20|0"; http.header_names; content:!"Referer|0d 0a|"; content:!"Accept|0d 0a|"; reference:url,blogs.cisco.com/security/watering-hole-attacks-target-energy-sector; classtype:exploit-kit; sid:2017544; rev:6; metadata:created_at 2013_09_30, confidence High, signature_severity Major, updated_at 2024_04_07;)