alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE RansomCrypt Getting Template"; flow:to_server,established; http.uri; content:"/lnd/template="; fast_pattern; pcre:"/\/[a-z0-9]+$/i"; http.user_agent; content:"MSIE 7.0|3b 20|Windows NT 5.1|3b|"; classtype:trojan-activity; sid:2016749; rev:3; metadata:created_at 2013_04_10, signature_severity Major, updated_at 2020_04_23;)