alert smtp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Onliner Template 1 Active - Malicious Outbound Email Spam"; flow:established,to_server; content:"Subject|3a 20|"; content:"Canada|20|Post"; within:80; content:"To|20|download|20|the|20|tracking|20|number"; distance:0; content:"in|20|the|20|zip|20|file.."; distance:0; fast_pattern; content:"Click|20|here|20|to|20|download|20|your|20|Tracking|20|Number"; distance:0; reference:url,www.blueliv.com/blog/research/analysis-spam-distribution-botnet-onliner-spambot/; classtype:trojan-activity; sid:2027811; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_08_06, deployment Perimeter, malware_family Onliner, performance_impact Low, confidence High, signature_severity Major, tag SpamBot, updated_at 2020_08_19;)