alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Banker/Bancos/Infostealer Possible Rootkit - HTTP HEAD Request"; flow:established,to_server; content:"HEAD"; http_method; nocase; content:".php?action="; http_uri; nocase; content:"&uid="; nocase; http_uri; content:"&locale="; nocase; http_uri; content:"&ver="; nocase; http_uri; content:"&build="; nocase; http_uri; reference:url,www.pctools.com/mrc/infections/id/Trojan.Banker/; reference:url,www.anti-spyware-101.com/remove-trojanbanker; classtype:trojan-activity; sid:2009750; rev:6; metadata:created_at 2010_07_30, malware_family Bancos, confidence Medium, signature_severity Major, tag Banking_Trojan, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2019_07_26;)