alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Stobox Connectivity Check"; flow:established,to_server; threshold:type both, count 5, seconds 300, track by_src; http.uri; content:"/windowsupdate/v6/thanks.aspx?ln=en&&thankspage="; fast_pattern; http.host; content:"update.microsoft.com"; depth:20; endswith; http.header_names; content:"|0d 0a|Host|0d 0a|"; depth:8; content:!"Accept-Language|0d 0a|"; content:!"Referer|0d 0a|"; content:!"Cookie|0d 0a|"; reference:md5,aba20c8289b37b10d42979730674a2ca; classtype:trojan-activity; sid:2019166; rev:7; metadata:created_at 2014_09_11, signature_severity Major, updated_at 2020_11_05;)