alert http $HOME_NET any -> $EXTERNAL_NET any (
msg:"ET INFO Fake Game Cheat Related POST Request";
flow:established,to_server;
http.method;
content:"POST";
http.uri;
content:"/api/"; startswith;
pcre:"/^\d\x2e\d/R";
http.request_body;
content:"type=init"; fast_pattern;
content:"ver|3d|";
pcre:"/^\d\x2e\d/R";
content:"hash|3d|";
pcre:"/^([a-f0-9]{2}\x20){15}[a-f0-9]{2}/R";
content:"enckey|3d|";
pcre:"/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{2}/R";
content:"name|3d|";
content:"ownerid|3d|";
reference:md5,1bcf37c39b0d6636b70f77c36ec74ae1;
classtype:bad-unknown;
sid:2050235; rev:1;
metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, affected_product Windows_11, attack_target Client_Endpoint, created_at 2024_01_19, deployment Perimeter, deployment SSLDecrypt, performance_impact Low, confidence High, signature_severity Informational, updated_at 2024_01_19;
target:src_ip;
)