alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Variant.Zusy.45802 Checkin"; flow:established,to_server; http.uri; content:".php?uid="; fast_pattern; content:"&affid="; pcre:"/\.php\?uid=[-a-f0-9]+?&affid=\d+$/i"; http.user_agent; content:"Mozilla/4.0 (compatible|3b 20|MSIE 6.0|3b 20|Windows NT 5.1)"; bsize:50; http.header_names; content:!"Referer|0d 0a|"; classtype:command-and-control; sid:2016816; rev:7; metadata:created_at 2013_05_04, deprecation_reason Age, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_01_29, reviewed_at 2024_01_29;)