alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Nubjub.A HTTP Check-in"; flow:established,to_server; http.method; content:"GET"; depth:3; http.uri; content:".php"; content:"?&mode="; fast_pattern; content:"&id="; content:"&output="; content:"&time="; classtype:trojan-activity; sid:2009521; rev:7; metadata:created_at 2010_07_30, malware_family Win32_Nubjub_A, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_05_01;)