alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Small.XR Checkin 2 WEBC2-CSON APT1 Related"; flow:to_server,established; urilen:27; http.uri; content:"/Default.aspx?ID="; pcre:"/^[A-Z]{10}$/R"; http.user_agent; content:!"Mozilla"; startswith; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=TrojanDownloader%3AWin32%2FSmall.XR; reference:url,www.mandiant.com/apt1; reference:md5,ba45339da92ca4622b472ac458f4c8f2; classtype:targeted-activity; sid:2016459; rev:6; metadata:created_at 2013_02_22, malware_family Win32_Small_XR, signature_severity Major, updated_at 2020_04_23;)