alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Potao CnC"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"<?xml version=|22|1.0|22|?>"; startswith; content:"10a7d030-1a61-11e3-beea-001c42e2a08b"; distance:24; fast_pattern; http.content_type; content:"application/xml"; classtype:command-and-control; sid:2021554; rev:6; metadata:created_at 2015_07_31, signature_severity Major, updated_at 2024_04_13;)