alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Trojan.Generic.5325921 Checkin"; flow:to_server,established; http.uri; content:"?p="; content:"&botmajor="; content:"&botminor="; content:"&osmajor="; content:"&osminor="; reference:md5,203cec547d7d7d7b3a51084ad1abd793; classtype:command-and-control; sid:2020090; rev:4; metadata:created_at 2015_01_05, signature_severity Major, updated_at 2020_05_14;)