alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Delf Alms backdoor checkin"; flow:established,to_server; http.uri; content:"/getnewv.php?keyword=google&id="; nocase; fast_pattern; http.user_agent; content:"Mozilla/5.0 (Windows|3b| U|3b| Windows NT 5.1|3b| en-US)"; classtype:command-and-control; sid:2012803; rev:6; metadata:created_at 2011_05_11, signature_severity Major, updated_at 2024_03_15;)