alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32.Spy/TVRat Checkin"; flow:to_server,established; http.method; content:"GET"; http.uri; content:".php?id="; fast_pattern; content:"&stat="; pcre:"/\.php\?id=\d+&stat=[a-z0-9]{32}(?:&cidl=\d+|&sidl=[\d%:\x20-]+)?$/"; http.header_names; content:!"Accept-"; content:!"Referer|0d 0a|"; reference:url,www.symantec.com/security_response/writeup.jsp?docid=2003-082915-1318-99; reference:url,damballa.com/tvspy-threat-actor-group-reappears/; classtype:command-and-control; sid:2021747; rev:13; metadata:created_at 2015_09_05, performance_impact Significant, signature_severity Major, updated_at 2024_04_29;)