alert http $HOME_NET any -> $EXTERNAL_NET 88 (msg:"ET MALWARE Virus.Win32.Sality.aa Checkin"; flow:established,to_server; http.uri; content:".txt"; endswith; http.user_agent; bsize:8; content:"Download"; fast_pattern; reference:md5,1e0e6717f72b66f6fc83f2ef6c00dcb7; classtype:command-and-control; sid:2014826; rev:6; metadata:created_at 2012_04_09, signature_severity Major, updated_at 2024_02_16;)