alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Hupigon URL Infection Checkin Detected"; flow:established,to_server; http.uri; content:"?mac="; nocase; content:"&ver="; nocase; content:"&user="; nocase; content:"&md5="; nocase; content:"&pc="; nocase; pcre:"/mac=[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}/i"; classtype:command-and-control; sid:2007592; rev:9; metadata:created_at 2010_07_30, signature_severity Major, updated_at 2020_09_04;)