alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Rootkit TDSS/Alureon Checkin 2"; flow:established,to_server; http.uri; content:"/dx.php?i="; pcre:"/^[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12}&a=/Ri"; content:"&x64="; content:"os="; content:"&f="; reference:url,contagiodump.blogspot.com/2011/02/tdss-tdl-4-alureon-32-bit-and-64-bit.html; classtype:command-and-control; sid:2012314; rev:4; metadata:created_at 2011_02_14, signature_severity Major, updated_at 2020_04_21;)