alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE RansomCrypt Intial Check-in"; flow:established,to_server; http.uri; pcre:"/^\/[a-z0-9]+$/i"; http.user_agent; content:"Windows NT 5.1|3b 20|ru|3b|"; content:"Gecko/20100722 Firefox/3.6.12"; endswith; fast_pattern; http.header_names; content:"|0d 0a|User-Agent|0d 0a|Host|0d 0a|"; classtype:trojan-activity; sid:2016748; rev:8; metadata:created_at 2013_04_10, deprecation_reason Age, signature_severity Major, updated_at 2024_05_29, reviewed_at 2024_01_29;)