ET MALWARE ELF/Mayhem Checkin

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"ET MALWARE ELF/Mayhem Checkin";
    flow:established,to_server;
    http.method;
    content:"POST"; nocase;
    http.header;
    content:"Pragma|3a 20|1337|0d 0a|"; fast_pattern;
    http.header_names;
    content:!"User-Agent|0d 0a|";
    content:!"Accept";
    content:!"Referer|0d 0a|";
    reference:url,blog.malwaremustdie.org/2014/05/elf-shared-so-dynamic-library-malware.html;
    classtype:command-and-control;
    sid:2018456; rev:5;
    metadata:affected_product Linux, created_at 2014_05_08, malware_family ELF_Mayhem, signature_severity Major, updated_at 2020_09_29;
)