alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Trojan/MSIL.bfsx Checkin"; flow:to_server,established; http.uri; content:"/infect"; fast_pattern; content:".php"; offset:7; pcre:"/\/infect(?:-\d)?\.php$/"; http.user_agent; content:"Microsoft"; bsize:9; reference:md5,506cd65bdd06f41f8219cd1ed78eac7d; reference:md5,0c39b39ee4a59a8ac5fc1df500da2a88; classtype:command-and-control; sid:2019840; rev:6; metadata:created_at 2014_12_03, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_09_28;)