ET HUNTING Suspicious POST Format

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"ET HUNTING Suspicious POST Format";
    flow:established,to_server;
    http.method;
    content:"POST";
    http.request_line;
    content:"/upload/upload.php HTTP/1.0"; fast_pattern;
    http.content_type;
    content:"application/x-www-form-urlencoded"; bsize:33;
    reference:url,norfolkinfosec.com/dprk-malware-targeting-security-researchers/;
    reference:url,blog.google/threat-analysis-group/new-campaign-targeting-security-researchers/;
    classtype:bad-unknown;
    sid:2031558; rev:1;
    metadata:created_at 2021_01_26, confidence Medium, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2021_01_26;
)