ET MALWARE FastPOS Initial Checkin

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"ET MALWARE FastPOS Initial Checkin";
    flow:to_server,established;
    http.method;
    content:"GET";
    http.uri;
    content:"/cdosys.php?"; fast_pattern;
    content:"=new&username="; distance:0;
    content:"&computername="; distance:0;
    content:"&os="; distance:0;
    content:"&architecture="; distance:0;
    reference:url,documents.trendmicro.com/assets/fastPOS-quick-and-easy-credit-card-theft.pdf;
    classtype:command-and-control;
    sid:2022862; rev:3;
    metadata:created_at 2016_06_06, confidence High, signature_severity Major, updated_at 2020_07_14;
)