ET MALWARE Win32/Necurs Common POST Header Structure

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"ET MALWARE Win32/Necurs Common POST Header Structure";
    flow:established,to_server;
    urilen:10<>20;
    http.method;
    content:"POST";
    http.uri;
    content:".php";
    http.user_agent;
    content:!"NSIS|5f|Inetc |28|Mozilla|29|";
    http.host;
    pcre:"/^(?:\d{1,3}\.){3}\d{1,3}/";
    http.request_body;
    pcre:"/^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]/";
    http.connection;
    content:"keep-alive"; nocase;
    http.content_type;
    content:"application/x-www-form-urlencoded"; endswith;
    http.content_len;
    byte_test:0,<=,400,0,string,dec;
    http.header_names;
    content:"|0d 0a|Content-Type|0d 0a|User-Agent|0d 0a|Host|0d 0a|Content-Length|0d 0a|Connection|0d 0a|"; depth:62; fast_pattern;
    content:!"Accept";
    content:!"Referer";
    reference:md5,d11a453d4de6e6fd991967d67947c0d7;
    classtype:trojan-activity;
    sid:2021995; rev:6;
    metadata:created_at 2015_10_23, malware_family Win32_Necurs, performance_impact Moderate, signature_severity Major, updated_at 2024_04_08;
)