alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/Threebyte.APT Checkin"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/UID"; fast_pattern; depth:4; content:".jsp?"; distance:0; pcre:"/^\/UID\d+\.jsp\?/"; http.header_names; content:!"Accept"; content:!"Referer|0d 0a|"; reference:url,fireeye.com/blog/technical/botnet-activities-research/2014/09/darwins-favorite-apt-group-2.html; classtype:targeted-activity; sid:2019114; rev:3; metadata:created_at 2014_09_04, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_05_04;)