alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET GAMES Solaris2 Checkin"; flow:established,to_server; http.request_line; content:"POST|20|/patch/serial.php|20|"; startswith; fast_pattern; http.user_agent; bsize:7; content:"Solaris"; http.request_body; content:"cpuid="; startswith; content:"&hddserial="; distance:0; content:"&macaddr="; distance:0; content:"&machineguid="; distance:16; within:13; content:"&name="; distance:0; content:"&serial="; distance:0; content:!"&"; distance:0; reference:md5,9953874a71e5df4a8b73a83db9576ae4; reference:url,solaris2.hu; classtype:misc-activity; sid:2037905; rev:2; metadata:attack_target Client_Endpoint, created_at 2022_08_03, deployment Perimeter, performance_impact Low, confidence High, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_26;)