Puntoloader snort/suricata rule

alert tcp any any -> any !$HTTP_PORTS (msg:"Punto Loader Checkin"; flow:established,to_server; content:"POST"; http_method; content:"klog.php"; http_uri; content:"Accept|3a| text|2f|html|3b|q=0|2e|7|2c 20 2a 2f 2a 3b|q=1"; http_header; classtype:trojan-activity; sid:20166287; rev:1; metadata:created_at 2019_02_19;)