alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE MegalodonHTTP/LuciferHTTP Client Action"; flow:established,to_server; http.method; content:"GET"; http.uri; content:".php?hwid="; fast_pattern; pcre:"/\.php\?hwid=[A-F0-9]{16}$/"; http.header_names; content:"|0d 0a|Host|0d 0a 0d 0a|"; startswith; reference:md5,966301e88d8a43abe1215413bfd48b09; reference:url,damballa.com/megalodonhttp-botnet-discovered-the-shark-paradox/; reference:md5,d543973bd33d45d515e8dfc251411c4b; classtype:trojan-activity; sid:2022127; rev:4; metadata:created_at 2015_11_23, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_10_05;)