alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Lurk Click fraud Template Request"; flow:to_server,established; http.request_line; content:"GET /log/"; fast_pattern; startswith; http.uri; content:"/?id="; pcre:"/^\/log\/[0-9]+\/[0-9]+\/\?id=[0-9]+$/"; http.header_names; content:!"User-Agent|0d 0a|"; content:!"Referer|0d 0a|"; content:"Host|0d 0a|"; reference:url,secureworks.com/cyber-threat-intelligence/threats/malware-analysis-of-the-lurk-downloader/; classtype:trojan-activity; sid:2018927; rev:3; metadata:created_at 2014_08_12, signature_severity Major, updated_at 2020_05_01;)