alert tcp any any -> any any (msg:"🐾 - ☣ Download request 🌐 Trickbot trojan ♞"; flow:to_server, stateless; content:"GET"; content:"/api.php"; content:"185.14.30.131"; fast_pattern; reference:url,https://twitter.com/i/web/status/1278225259414671360; reference:url,https://malpedia.caad.fkie.fraunhofer.de/details/win.trickbot; metadata:created_at 2020_07_02, updated_at 2020_07_04; sid:3321019; rev:1; classtype:trojan-activity;)