alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Snap Bot Checkin"; flow:established,to_server; http.request_body; content:"id="; startswith; content:"&s5_uidx="; fast_pattern; distance:0; content:"&os="; distance:0; content:"&s5="; distance:0; reference:md5,a45a1ccf6842b032b7f2ef2f2255c81c; reference:md5,e070ce714e343052d19a7e3213ee2a9a; reference:url,ddanchev.blogspot.com/2011/05/peek-inside-new-ddos-bot-snap.html; classtype:command-and-control; sid:2014731; rev:3; metadata:created_at 2012_05_11, signature_severity Major, updated_at 2024_03_08;)