alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Urlzone/Bebloh Communication with Controller"; flow:established,to_server; content:"GET"; nocase; http_method; content:"?type=slg&id="; http_uri; nocase; pcre:"/\?type=slg&id=[0-9A-Z]{18}/U"; reference:url,threatinfo.trendmicro.com/vinfo/grayware/ve_graywareDetails.asp?GNAME=TSPY_BEBLOH.KO&VSect=Td; classtype:trojan-activity; sid:2009351; rev:8; metadata:created_at 2010_07_30, malware_family URLZone, signature_severity Major, tag Banking_Trojan, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2019_07_26;)