alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE FakeAV.dfze/FakeAV!IK Checkin"; flow:established,to_server; urilen:>150; http.method; content:"GET"; http.uri; pcre:"/^\/(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$/"; http.header; content:"|0d 0a|Cache-Control|3a 20|no-cache|0d 0a 0d 0a|"; http.host; content:!"pandora.com"; content:!"wordpress.com"; http.start; content:"= HTTP/1.1|0D 0A|Host|3a 20|"; fast_pattern; http.header_names; content:!"User-Agent|0d 0a|"; reference:md5,fe1e735ec10fb8836691fe2f2ac7ea44; classtype:command-and-control; sid:2014409; rev:9; metadata:created_at 2012_03_22, performance_impact Significant, signature_severity Major, updated_at 2024_04_08;)