alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/Downvision.A Initial Checkin"; flow:established,to_server; http.uri; content:"/up.php?id=201"; http.header; content:"software IPWorks HTTP/S Component - www.nsoftware.com"; reference:url,www.fortiguard.com/av/VID3309956; classtype:command-and-control; sid:2014610; rev:5; metadata:created_at 2012_04_17, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_04_21;)