alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED W32/Alworo CnC Checkin"; flow:established,to_server; content:".php?userid="; nocase; http_uri; content:"&time="; nocase; http_uri; content:"&msg="; nocase; http_uri; content:"&ver="; nocase; http_uri; content:"&pauid="; nocase; http_uri; content:"&checkId="; nocase; http_uri; reference:url,us.norton.com/security_response/writeup.jsp?docid=2011-062909-5644-99&tabid=2; classtype:command-and-control; sid:2013215; rev:3; metadata:created_at 2011_07_06, signature_severity Unknown, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2019_07_26;)