alert tcp any any -> any any (msg:"🐾 - ☣ Download request 🌐 Trickbot trojan ♞"; flow:to_server, stateless; content:"GET"; content:"/file.php"; content:"88.218.16.9"; fast_pattern; reference:url,https://twitter.com/i/web/status/1278225259414671360; reference:url,https://malpedia.caad.fkie.fraunhofer.de/details/win.trickbot; metadata:created_at 2020_07_02, updated_at 2020_07_04; sid:3321017; rev:1; classtype:trojan-activity;)