alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET POLICY ICP Email Send via HTTP - Often Trojan Install Reports"; flow:established,to_server; http.uri; content:"/friendship/email_thank_you.php?"; nocase; content:"folder_id="; nocase; content:"&params_count="; nocase; content:"&nick_name="; nocase; content:"&user_email="; nocase; content:"&user_uin="; nocase; content:"&friend_nickname="; nocase; content:"&friend_contact="; nocase; classtype:policy-violation; sid:2008351; rev:5; metadata:created_at 2010_07_30, confidence High, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_04_20;)