alert tcp $HOME_NET any -> 76.74.9.18 $HTTP_PORTS (msg:"ET DELETED Milw0rm Exploit Launch Attempt"; flow:to_server,established; content:"GET "; depth:4; content:"/exploit.php?id="; http_uri; nocase; reference:url,www.milw0rm.com; classtype:misc-activity; sid:2009586; rev:4; metadata:created_at 2010_07_30, signature_severity Unknown, updated_at 2019_08_22;)