alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Nemucod Downloading Payload 2"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/document.php?rnd="; depth:18; fast_pattern; content:"&id="; distance:0; pcre:"/^\/document\.php\?rnd=[0-9]{4}&id=[A-F0-9]{100,}$/i"; http.header_names; content:!"Referer|0d 0a|"; reference:url,trendmicro.com/vinfo/us/threat-encyclopedia/malware/js_nemucod.hqk; classtype:trojan-activity; sid:2021956; rev:4; metadata:created_at 2015_10_16, signature_severity Major, updated_at 2020_06_04;)