alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/Jiwerks.A Checkin"; flow:established,to_server; content:"|0d 0a 0d 0a|a="; fast_pattern; http.method; content:"POST"; nocase; http.uri; content:"/update.aspx"; http.accept_lang; content:"zh-cn"; http.request_body; content:"a="; depth:2; content:"&v="; distance:0; reference:md5,0e47c711d9edee337575b6dbef850514; classtype:command-and-control; sid:2014133; rev:5; metadata:created_at 2012_01_18, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_04_21;)