alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Densmail.com Related Trojan Checkin"; flow:established,to_server; http.uri; content:"/cc.php"; nocase; content:"v="; nocase; content:"&rnd="; nocase; distance:0; pcre:"/v=\d+&rnd=\d/i"; classtype:command-and-control; sid:2007822; rev:6; metadata:created_at 2010_07_30, signature_severity Major, updated_at 2020_04_22;)