alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Torpig Infection Reporting"; flow:established,to_server; urilen:>100; http.method; content:"POST"; startswith; http.uri; pcre:"/^\/[0-9A-F]{16}\/[0-9A-Za-z\+\/]{100,}$/"; http.connection; bsize:5; content:"close"; http.content_len; byte_test:0,>,0,0,string,dec; http.header_names; content:!"|0d 0a|User-Agent|0d 0a|"; reference:url,www2.gmer.net/mbr/; reference:url,www.cs.ucsb.edu/~seclab/projects/torpig/torpig.pdf; reference:url,offensivecomputing.net/?q=node/909; classtype:trojan-activity; sid:2008660; rev:12; metadata:created_at 2010_07_30, deprecation_reason Performance, performance_impact Significant, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_04_14;)