alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Agent.WMN CnC Beacon"; flow:established,to_server; http.method; content:"POST"; http.uri; content:".php"; http.header; strip_pseudo_headers; header_lowercase; content:"content-type|3a 20|application|2f|x-www-form-urlencoded|0d 0a|user-agent"; startswith; fast_pattern; http.request_body; content:"="; offset:4; depth:9; content:"=&"; distance:55; within:2; pcre:"/^[a-z]{4,12}=(?:[A-Za-z0-9+/]{4})*[A-Za-z0-9+/]{3}=&[a-z]{4,12}=[A-Za-z0-9+/]{4}/"; reference:md5,3031604f1cf95ee4ccc339c9e4d5b92f; classtype:command-and-control; sid:2020708; rev:5; metadata:attack_target Client_Endpoint, created_at 2015_03_18, deployment Perimeter, malware_family Win32_Agent_WMN, signature_severity Major, tag c2, updated_at 2024_04_30, mitre_tactic_id TA0010, mitre_tactic_name Exfiltration, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)