alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Virtumonde Variant Reporting to Controller via HTTP (2)"; flow:established,to_server; http.uri; content:"php?"; nocase; content:"cmp="; nocase; content:"&guid="; nocase; content:"&affid="; nocase; content:"&run="; nocase; content:"&dn_uid="; nocase; content:"&dn_affid="; nocase; content:"&vm_guid="; fast_pattern; nocase; content:"&ip="; nocase; content:"&altid="; nocase; classtype:trojan-activity; sid:2007285; rev:5; metadata:created_at 2010_07_30, signature_severity Major, updated_at 2024_03_10;)