alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Goldun Reporting User Activity 2"; flow:established,to_server; http.uri; content:"?phid="; nocase; content:"&ver="; nocase; content:"&nn="; fast_pattern; nocase; http.user_agent; bsize:1; content:"z"; reference:url,www.avira.com/en/threats/TR_Spy_Goldun_de_1_details.html; classtype:trojan-activity; sid:2002780; rev:9; metadata:created_at 2010_07_30, signature_severity Major, updated_at 2024_02_22;)