alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Hiloti/Mufanom Downloader Checkin"; flow:established,to_server; flowbits:set,ET.Hiloti; http.uri; content:"/get"; nocase; content:".php?c="; nocase; distance:0; content:"&d="; nocase; distance:0; pcre:"/\/get\d*\.php\?c=[A-Z]{8}&d=[0-9A-F]{250,}$/"; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Trojan%3aWin32%2fHiloti.gen!A; reference:url,blog.fortinet.com/hiloti-the-botmaster-of-disguise/; classtype:command-and-control; sid:2010071; rev:11; metadata:created_at 2010_07_30, signature_severity Major, updated_at 2020_04_27;)