alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/UltimateDefender.FakeAV Checkin"; flow:established,to_server; http.uri; content:"/show_module.php?IsAutoGeneratedPage="; content:"&asked_billing_id="; content:"&original_asked_billing_id="; content:"&brokerid="; content:"&country="; content:"&customid="; content:"&product="; content:"&custom_param="; content:"&extparam="; content:"&nums="; reference:md5,cec40236236466a1acb33aca3220eebe; classtype:command-and-control; sid:2014566; rev:4; metadata:created_at 2012_04_16, signature_severity Major, updated_at 2020_08_04;)