alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Darkness DDoS Bot Checkin"; flow:established,to_server; http.uri; content:".php?uid="; nocase; content:"&ver="; distance:0; pcre:"/\.php\?uid=\d{5,6}&ver=[^&]+(?:&traff=\d+)?$/"; http.header_names; content:!"Accept|0d 0a|"; http.user_agent; content:"darkness"; depth:8; fast_pattern; reference:url,www.shadowserver.org/wiki/pmwiki.php/Calendar/20101205; reference:md5,7fcebf5bd67cede35d08bedd683e3524; reference:md5,60c84bb1ca03f80ca385f16946322440; reference:md5,778113cc4e758ed65de0123bb79cbd1f; reference:md5,55edeb8742f0c38aaa3d984eb4205c68; reference:url,ef.kaffenews.com/?p=833; classtype:command-and-control; sid:2011996; rev:14; metadata:created_at 2010_12_06, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_05_19;)