alert tcp $HOME_NET any -> $EXTERNAL_NET [8000,8003,9004:] (msg:"ET MALWARE W32Autorun.worm.aaeh Checkin"; flow:established,to_server; content:"Host|3a| ns1.help"; pcre:"/^Host\x3a\x20ns1\.help(?:update(?:d\.(?:com?|net?|org?)|k\.(?:at?|eu?|tw)|r\.net|s\.com)|checks\.net)/mi"; reference:url,www.mcafee.com/threat-intelligence/malware/default.aspx?id=1607456; classtype:command-and-control; sid:2019711; rev:4; metadata:created_at 2014_11_15, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2019_07_26;)