alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT Observed LordEK HTTP POST Request"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/?"; startswith; pcre:"/^(?:[A-Z0-9+/]{4})*(?:[A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$/Ri"; http.request_body; content:"|7b 22|flash|22 3a|"; startswith; fast_pattern; content:"|22|ip_address|22 3a 22|"; distance:0; content:"|22|country|22 3a 22|"; distance:0; http.header_names; to_lowercase; content:"|0d 0a|referer|0d 0a|"; reference:url,www.malware-traffic-analysis.net/2019/08/01/index.html; classtype:exploit-kit; sid:2027788; rev:4; metadata:created_at 2019_08_02, deployment Perimeter, malware_family LordEK, performance_impact Low, signature_severity Major, tag Exploit_Kit, updated_at 2024_05_01;)