alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE ZeroAccess Checkin"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/counter.img?theme="; fast_pattern; content:"&digits="; content:"&siteId="; http.user_agent; content:"Opera/9 (Windows NT"; reference:url,sophos.com/en-us/medialibrary/PDFs/technical%20papers/Sophos_ZeroAccess_Botnet.pdf; reference:url,malwaremustdie.blogspot.co.uk/2013/02/blackhole-of-closest-version-with.html; classtype:command-and-control; sid:2015723; rev:6; metadata:created_at 2012_09_21, signature_severity Major, updated_at 2020_09_23;)