alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Trojan.Win32.A.FakeAV Reporting"; flow:established,to_server; http.method; content:"GET"; nocase; http.uri; content:"/404.php?"; nocase; content:"type=stats"; nocase; content:"affid="; nocase; content:"subid="; nocase; reference:url,securelist.com/en/descriptions/24405309/Trojan.Win32.FakeAV.dlbc; reference:md5,ac0ba9e186aee9cf9889d71158485715; classtype:trojan-activity; sid:2014083; rev:6; metadata:created_at 2012_01_03, signature_severity Major, updated_at 2020_04_29;)