alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Trojan.Win32.Webprefix checkin"; flow:established,to_server; http.method; content:"GET"; http.uri; content:".php?email="; fast_pattern; http.header_names; content:!"|0d 0a|Accept-"; content:!"|0d 0a|Referer|0d 0a|"; content:!"|0d 0a|User-Agent|0d 0a|"; content:"|0d 0a|Accept|0d 0a|Connection|0d 0a|Host|0d 0a|"; startswith; reference:md5,8284c2202342102000ae9a04dd07bb76; classtype:command-and-control; sid:2018481; rev:10; metadata:created_at 2012_01_23, signature_severity Major, updated_at 2024_03_01;)