alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET POLICY BitCoin"; flow:established,to_server; threshold:type limit, count 2, seconds 300, track by_src; http.uri; content:"/api/work/getwork?"; depth:18; http.header; content:"bitcoinplus.com"; classtype:coin-mining; sid:2013059; rev:4; metadata:created_at 2011_06_17, confidence High, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_04_20;)