alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Haken Clicker CnC Activity"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/api_v5/facebook_api.php?n="; fast_pattern; reference:url,research.checkpoint.com/2020/android-app-fraud-haken-clicker-and-joker-premium-dialer/; reference:md5,02939b68596873ad1835d1062ee8836a; classtype:command-and-control; sid:2030836; rev:1; metadata:attack_target Mobile_Client, created_at 2020_09_04, deployment Perimeter, performance_impact Low, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_09_04;)