alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Alina Checkin"; flow:established,to_server; http.method; content:"POST"; nocase; http.uri; content:".php"; http.user_agent; content:"Alina v"; http.request_body; content:"act="; content:"&b="; content:"&c="; content:"&v="; reference:url,blog.spiderlabs.com/2013/05/alina-shedding-some-light-on-this-malware-family.html; classtype:command-and-control; sid:2016837; rev:8; metadata:created_at 2013_05_09, deprecation_reason Age, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_01_30, reviewed_at 2024_01_30;)