alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Unknown Checkin"; flow:established,to_server; http.method; content:"POST"; http.uri; pcre:"/\/[a-z]\/$/Ui"; http.user_agent; content:"(compatible|3b|"; content:"|20|MSIE|20|"; distance:0; content:"(Compatible|3b|"; fast_pattern; distance:0; classtype:command-and-control; sid:2016829; rev:4; metadata:created_at 2013_05_07, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_04_24;)