alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Taidoor Checkin"; urilen:32; http.uri; content:".php?id="; offset:6; depth:8; pcre:"/^[A-Z0-9]{18}$/R"; http.user_agent; content:"MSIE 6.0|3b|"; reference:md5,f4b8b51b75f67e68d0c1a9639e2488c3; classtype:command-and-control; sid:2015808; rev:7; metadata:created_at 2012_10_17, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_08_17;)