alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Antivirus2010 Checkin port 8082"; flow:established,to_server; http.uri; content:"/ask?"; content:"&u="; content:"a="; content:"&m="; content:"&h="; reference:url,blog.emsisoft.com/2010/08/09/antivirus2010-userinit-and-then-some-more/; classtype:command-and-control; sid:2011473; rev:5; metadata:created_at 2010_09_29, signature_severity Major, updated_at 2022_04_18;)