alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Rogue AV Downloader concat URI"; flow:established,to_server; http.uri; content:".php?id="; content:"x="; distance:0; content:"os="; distance:0; content:"n="; distance:0; pcre:"/\.php\?id=[a-zA-Z]{15,}&?x=\d+&?os=[0-9.]+&?n=\d/"; reference:url,malwareurl.com; classtype:trojan-activity; sid:2011925; rev:7; metadata:created_at 2010_11_15, signature_severity Major, updated_at 2020_05_06;)