alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Backdoor.Win32/PcClient.AA Checkin"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/2015"; startswith; fast_pattern; pcre:"/^\d+?\/(?:\d+?\/-?\d+?\.(?:php|jsp))?$/Ri"; http.user_agent; content:"Mozilla/4.0 (compatible|3b| MSIE 7.0|3b| Windows NT 5.2|3b| .NET CLR 1.1.4322|3b| .NET CLR 2.0.50727|3b| InfoPath.1)"; reference:md5,33439543cae709aa7efa58f94e4b2a62; classtype:command-and-control; sid:2019201; rev:15; metadata:created_at 2014_01_31, deprecation_reason Age, signature_severity Major, updated_at 2024_04_13, reviewed_at 2024_02_14;)