alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Solarbot Check-in"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"v="; startswith; content:"&u="; content:"&w="; content:"&c="; pcre:"/&s=\{?[0-9a-f]{8}-?[0-9a-f]{4}-?[0-9a-f]{4}-?[0-9a-f]{4}-?[0-9a-f]{12}\}?(?:&|$)/i"; http.header_names; to_lowercase; content:!"|0d 0a|referer|0d 0a|"; reference:url,blog.avast.com/2013/09/25/win3264napolar-new-trojan-shines-on-the-cyber-crime-scene/; reference:url,www.welivesecurity.com/2013/09/25/win32napolar-a-new-bot-on-the-block/; reference:md5,2c344add2ee6201f4e2cdf604548408b; classtype:trojan-activity; sid:2017742; rev:7; metadata:created_at 2013_11_22, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_05_01;)