alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE HotLan.C Spambot Trojan Activity"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"|3F|mod|3D|"; fast_pattern; content:"&id="; content:"&up="; content:"&mid="; pcre:"/\x3Fmod\x3D\w*?\x26id\x3D[^\x26\s]+?\x5F\w+?\x26up\x3D[^\x26]+?\x26mid\x3D[^\x26\s]/i"; classtype:trojan-activity; sid:2008473; rev:10; metadata:created_at 2010_07_30, signature_severity Major, updated_at 2024_03_16;)