ET EXPLOIT_KIT ScanBox Framework used in WateringHole Attacks Initial (POST)

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"ET EXPLOIT_KIT ScanBox Framework used in WateringHole Attacks Initial (POST)";
    flow:to_server,established;
    http.method;
    content:"POST";
    http.uri;
    content:".php"; endswith;
    http.request_body;
    content:"seed="; fast_pattern;
    content:"&referrer=";
    content:"&agent=";
    content:"&location=";
    content:"&toplocation=";
    reference:url,www.alienvault.com/open-threat-exchange/blog/scanbox-a-reconnaissance-framework-used-on-watering-hole-attacks;
    classtype:exploit-kit;
    sid:2019094; rev:8;
    metadata:created_at 2014_08_30, signature_severity Major, updated_at 2020_09_17;
)