alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Smoke Loader Checkin r=gate"; flow:established,to_server; http.uri; content:".php?r=gate&"; content:"&group="; distance:0; content:"&debug="; distance:0; http.user_agent; content:"5.0 (Windows|3b 20|U|3b 20|MSIE 9"; reference:md5,7ef1e61d9b394a972516cc453bf0ec06; classtype:command-and-control; sid:2014728; rev:7; metadata:created_at 2012_05_10, signature_severity Major, updated_at 2020_05_13;)