alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Comfoo Checkin"; flow:established,to_server; http.method; content:"GET"; http.uri; pcre:"/^\/[a-zA-Z0-9\+\/]+={0,2}\/[a-zA-Z0-9\+\/]+={0,2}\d{5}\/\d+\/\d{2}[a-zA-Z0-9\+\/]+={0,2}\/[a-zA-Z0-9\+\/]+={0,2}\d{3}\/$/"; http.user_agent; content:"|3b|Windows"; nocase; reference:url,www.secureworks.com/cyber-threat-intelligence/threats/secrets-of-the-comfoo-masters/; classtype:command-and-control; sid:2017262; rev:6; metadata:created_at 2013_08_01, signature_severity Major, updated_at 2020_04_24;)