alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Trojan-Dropper.Win32.Agent.ksja"; flow:established,to_server; http.uri; content:".php?m="; fast_pattern; pcre:"/\.php\?m=[A-F0-9]{12}/"; http.user_agent; bsize:35; content:"Mozilla|2f|4|2e|0|20 28|Compatible|3b 20|MSIE|20|6|2e|0|3b 29|"; http.header_names; content:!"Connection|0d 0a|"; content:!"|0d 0a|Referer|0d 0a|"; content:"|0d 0a|User-Agent|0d 0a|Host|0d 0a|"; startswith; content:"|0d 0a|Accept|0d 0a|"; reference:md5,3b440e052da726942763d11cf9e3f72c; classtype:trojan-activity; sid:2018507; rev:6; metadata:created_at 2014_05_29, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_11;)