alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE FakeAV Landing Page"; flow:established,to_server; http.uri; content:".cgi?p="; content:"&i="; content:"&j="; content:"&m="; content:"&h="; content:"&u="; content:"&q="; content:"&t=201"; reference:url,www.symantec.com/business/security_response/attacksignatures/detail.jsp?asid=23514; classtype:trojan-activity; sid:2013332; rev:5; metadata:created_at 2011_07_27, signature_severity Major, updated_at 2020_04_20;)