alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE IRC potential bot commands"; flow:established,from_server; content:"PRIVMSG "; depth:8; content:"|3a|"; within:30; pcre:"/((\.aim\w*|ascanall|\x3agetshit200)\s+\w+)|((@kill|@get_os_version|@get_computer_name|@get_bot_version|@update|@restart|@reboot|@shutdown)\s)/i"; classtype:trojan-activity; sid:2002384; rev:17; metadata:created_at 2010_07_30, signature_severity Major, updated_at 2019_07_26;)