alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Saint Bot CnC Activity"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/gate.php"; http.accept; content:"text|2f|plain"; startswith; http.request_body; content:"transfer="; startswith; fast_pattern; pcre:"/^transfer=[A-Za-z0-9/+=]+$/"; reference:md5,b1f40eac7ca6d66ba9b11dcf77f1a259; reference:url,blog.malwarebytes.com/threat-analysis/2021/04/a-deep-dive-into-saint-bot-downloader/; classtype:trojan-activity; sid:2032753; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2021_03_16, deployment Perimeter, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_05_01;)