pcre:"/^POST\x20.*\d{6,12}\x2ephp\x20HTTP\x2f1.*\r\n\r\n[a-z0-9\x2d]{4,15}\x3a[A-F0-9]{2}\x2d[A-F0-9]{2}\x2d[A-F0-9]{2}\x2d[A-F09]{2}\x2d[A-F0-9]{2}\x2d[A-F0-9]{2}/s"; reference:url,www.secureworks.com/research/threats/sindigoo/; sid:1111111114;)