alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE HotLan.C Spambot Trojan Activity"; flow:to_server,established; content:"GET"; http_method; content:"|3F|mod|3D|"; fast_pattern:only; http_uri; content:"&id="; http_uri; content:"&up="; http_uri; content:"&mid="; http_uri; pcre:"/\x3Fmod\x3D\w*?\x26id\x3D[^\x26\s]+?\x5F\w+?\x26up\x3D[^\x26]+?\x26mid\x3D[^\x26\s]/Ui"; classtype:trojan-activity; sid:2008473; rev:9; metadata:created_at 2010_07_30, signature_severity Major, updated_at 2019_07_26;)