alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE DNSTrojan FakeAV Dropper Activity Observed (2)"; flow:established,to_server; http.uri; content:"/getfile.php?r="; nocase; content:"&p="; nocase; pcre:"/\/getfile\.php\?r=-?\d+&p=/"; reference:url,www.abuse.ch/?p=2796; reference:url,www.abuse.ch/?p=2740; reference:md5,c59cdd1366dd5c2f448c03738ec0dc88; reference:md5,b93360ec3798215a5cca573747df0139; classtype:trojan-activity; sid:2011578; rev:5; metadata:created_at 2010_09_27, signature_severity Major, updated_at 2020_09_11;)