alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/Scar Downloader Request"; flow:established,to_server; http.uri; content:"/tasksz.php?"; fast_pattern; pcre:"/\/tasksz\.php\?(?:dc|load)/"; http.user_agent; content:"Google Bot"; bsize:10; reference:url,www.f-secure.com/v-descs/trojan_w32_scar_a.shtml; classtype:trojan-activity; sid:2010288; rev:6; metadata:created_at 2010_07_30, signature_severity Major, updated_at 2020_09_24;)