alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Mal/Ransom-CE Connectivity Check"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/windows"; fast_pattern; endswith; http.user_agent; content:"MSIE"; http.host; content:"www.microsoft.com"; bsize:17; http.header_names; content:!"Accept"; content:!"Referer|0d 0a|"; content:"|0d 0a|User-Agent|0d 0a|"; startswith; reference:md5,6faa7077de347ee0fa8c991934c2c3a5; reference:md5,a1fe3a7ff1ec997411b71212483eea33; reference:md5,97c0000473c5004d2e8c0464e322f429; classtype:trojan-activity; sid:2018295; rev:6; metadata:created_at 2014_03_18, performance_impact Moderate, signature_severity Major, updated_at 2024_04_08;)