alert http1 $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Dridex POST Retrieving Second Stage"; flow:established,to_server; http.host; pcre:"/^[^\r\n\x20]+\x20[a-z]/i"; http.request_body; pcre:"/^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]/"; http.request_line; content:"POST / HTTP/1.1"; fast_pattern; http.content_len; byte_test:0,>=,190,0,string,dec; reference:md5,6948d4f22e8d57369988be219ab70335; classtype:trojan-activity; sid:2020470; rev:11; metadata:created_at 2015_02_18, signature_severity Major, updated_at 2024_04_07;)