alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Fake DHL Kuluoz.B URI"; flow:established,to_server; content:".php?get"; http_uri; fast_pattern:only; pcre:"/\.php\?get[^=]*=\d_\d{5,}$/U"; content:!"Referer|3a 20|"; http_header; classtype:trojan-activity; sid:2016779; rev:5; metadata:created_at 2013_04_23, signature_severity Unknown, updated_at 2019_09_09;)