alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE SpyEye C&C Check-in URI"; flow:established,to_server; http.uri; content:"guid="; content:"ver="; content:"stat="; fast_pattern; content:"ie="; content:"os="; pcre:"/(\?|&)guid=[^!&]+?\!/"; reference:url,www.symantec.com/connect/blogs/spyeye-bot-versus-zeus-bot; reference:url,krebsonsecurity.com/2010/10/spyeye-v-zeus-rivalry-ends-in-quiet-merger/; classtype:command-and-control; sid:2011857; rev:7; metadata:created_at 2010_10_27, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_04_27;)