alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE DonBot Checkin"; flow:established,to_server; http.method; content:"POST"; nocase; http.uri; content:"/gateway/index"; http.protocol; content:"HTTP/1.0"; reference:url,labs.m86security.com/2011/06/new-bots-old-bots-ii-donbot/; classtype:command-and-control; sid:2013047; rev:6; metadata:created_at 2011_06_16, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_10_28;)