alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Dirt Jumper/Russkill3 Checkin"; flow:established,to_server; content:"|0d 0a 0d 0a|k="; fast_pattern; http.method; content:"POST"; nocase; http.request_body; content:"k="; depth:2; pcre:"/^\d{15}/R"; http.protocol; content:"HTTP/1.0"; reference:md5,10e7af7057833a19097cb22ba0bd1b99; reference:url,asert.arbornetworks.com/2011/08/dirt-jumper-caught/; reference:url,www.deependresearch.org/2011/10/dirt-jumper-ddos-bot-new-versions-new.html; classtype:command-and-control; sid:2013439; rev:12; metadata:created_at 2011_08_03, signature_severity Major, updated_at 2020_10_28;)