alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET MALWARE User-Agent (Visbot)"; flow:to_server,established; http.user_agent; content:"Visbot"; fast_pattern; startswith; reference:url,www.bleepingcomputer.com/news/security/visbot-malware-found-on-6-691-magento-online-stores/; classtype:trojan-activity; sid:2023575; rev:4; metadata:affected_product Magento, attack_target Web_Server, created_at 2016_12_02, deployment Datacenter, malware_family Visbot, performance_impact Low, confidence High, signature_severity Major, updated_at 2020_10_07;)