alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO Possible Rogue LoJack Asset Tracking Agent"; flow:established,to_server; urilen:1; http.method; content:"POST"; http.header_names; to_lowercase; content:"|0d 0a|tagid|0d 0a|"; fast_pattern; http.host; content:!".namequery.com"; threshold:type limit, count 2, seconds 300, track by_src; reference:url,web.archive.org/web/20181003233200/https://asert.arbornetworks.com/lojack-becomes-a-double-agent/; reference:url,www.blackhat.com/docs/us-14/materials/us-14-Kamluk-Computrace-Backdoor-Revisited-WP.pdf; classtype:misc-activity; sid:2025553; rev:6; metadata:attack_target Client_Endpoint, created_at 2018_05_02, deployment Perimeter, confidence Medium, signature_severity Informational, updated_at 2024_04_26;)