alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32.Small.AB or related Post-infection checkin"; flow:established,to_server; http.uri; content:"/work.php?"; nocase; content:"method="; nocase; content:"&port="; nocase; content:"&type="; nocase; content:"&winver="; nocase; classtype:command-and-control; sid:2008321; rev:5; metadata:created_at 2010_07_30, signature_severity Major, updated_at 2020_09_02;)