alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Possible Ponmocup Driveby Download"; flow:established,to_server; http.method; content:"GET"; nocase; http.uri; content:"/se/"; nocase; pcre:"/^[a-f0-9]{100,200}\/[a-f0-9]{6,9}\/[A-Z0-9_]{4,200}\.com/Ri"; reference:url,www9.dyndns-server.com%3a8080/pub/botnet/r-cgi_malware_analyse.txt; classtype:bad-unknown; sid:2013312; rev:4; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2011_07_26, deployment Perimeter, confidence Medium, signature_severity Major, tag DriveBy, updated_at 2020_04_21;)