alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Knok.php Shiz or Rohimafo Host Information Submission to CnC Server"; flow:established,to_server; content:"GET"; http_method; nocase; content:"/knok.php?id="; nocase; http_uri; content:"&ver="; nocase; http_uri; content:"&up="; nocase; http_uri; content:"&os="; nocase; http_uri; reference:url,asert.arbornetworks.com/2010/09/shiz-and-rohimafo-malware-cousins/; reference:md5,0bb4662b54f02c989edc520314fc20ea; reference:md5,a671eb9979505119f4106a990c4ef7ab; reference:md5,3614d4f6527d512b61c27c4e213347a6; classtype:command-and-control; sid:2011524; rev:3; metadata:created_at 2010_09_29, signature_severity Unknown, updated_at 2019_07_26;)