alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Waledac 2.0/Storm Worm 3.0 GET request detected"; flow:established,to_server; urilen:1; http.method; content:"GET"; nocase; http.uri; content:"/"; http.user_agent; bsize:63; content:"Mozilla|2f|4|2e|0|2028|compatible|3b20|MSIE|20|8|2e|0|3b20|Windows|20|NT|20|6|2e|1|3b20|Trident|2f|4|2e|0|29|"; http.header_names; content:"|0d 0a|Content-Length|0d 0a|"; http.request_body; content:"|01 02 01 01 01 01 02 01|"; fast_pattern; startswith; classtype:trojan-activity; sid:2012136; rev:11; metadata:created_at 2011_01_05, confidence Medium, signature_severity Major, updated_at 2024_02_23;)