alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Hitpop Checkin"; flow:established,to_server; http.uri; content:"/stat.htm?id="; fast_pattern; nocase; content:"&agt="; nocase; content:"&r=http"; nocase; content:"&OS="; nocase; content:"&ntime="; nocase; content:"&rtime="; nocase; reference:url,atlas-public.ec2.arbor.net/docs/Hitpop_DDoS_Malware_Analysis_PUBLIC.pdf; classtype:command-and-control; sid:2008275; rev:6; metadata:created_at 2010_07_30, signature_severity Major, updated_at 2024_03_16;)