alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Urausy.C Checkin 4"; flow:established,to_server; urilen:>80; http.method; content:"GET"; http.uri; pcre:"/\/(?:[^\x2f]+?\/)?[a-z-_]+?\.(?:php|html)$/i"; http.user_agent; bsize:63; content:"Mozilla/5.0 (compatible|3b| MSIE 9.0|3b| Windows NT 6.1|3b| Trident/5.0)"; fast_pattern; http.header_names; content:!"|0d 0a|Referer|0d 0a|"; content:!"|0d 0a|Accept|0d 0a|"; content:"|0d 0a|User-Agent|0d 0a|"; startswith; reference:md5,0032856449dbef5e63b8ed2f7a61fff9; classtype:command-and-control; sid:2017903; rev:6; metadata:created_at 2013_12_27, deprecation_reason Age, malware_family Win32_Urausy_C, signature_severity Major, updated_at 2024_03_12, reviewed_at 2024_02_08;)