alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Stpage Checkin (nomodem)"; flow:established,to_server; http.uri; content:"/nomodem.php"; fast_pattern; content:"if="; content:"&am="; content:"&cl={"; content:"&id="; classtype:command-and-control; sid:2008522; rev:4; metadata:created_at 2010_07_30, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_10;)