alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Hitpop Checkin"; flow:established,to_server; content:"/stat.htm?id="; nocase; http_uri; content:"&agt="; nocase; http_uri; content:"&r=http"; http_uri; nocase; content:"&OS="; nocase; http_uri; content:"&ntime="; nocase; http_uri; content:"&rtime="; nocase; http_uri; reference:url,atlas-public.ec2.arbor.net/docs/Hitpop_DDoS_Malware_Analysis_PUBLIC.pdf; classtype:command-and-control; sid:2008275; rev:5; metadata:created_at 2010_07_30, signature_severity Major, updated_at 2019_07_26;)