alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Downadup/Conficker A Worm reporting"; flow:to_server,established; content:"/search?q="; http_uri; content:"&aq="; http_uri; pcre:"/\/search\?q\=\d+&aq=\d/mi"; reference:url,www.f-secure.com/weblog/archives/00001584.html; classtype:trojan-activity; sid:2009114; rev:7; metadata:created_at 2010_07_30, signature_severity Major, updated_at 2019_07_26;)