alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Nubjub.A HTTP Check-in"; flow:established,to_server; http.method; content:"GET"; startswith; http.uri; content:".php"; content:"?&mode="; fast_pattern; content:"&id="; content:"&output="; content:"&time="; classtype:trojan-activity; sid:2009521; rev:8; metadata:created_at 2010_07_30, malware_family Win32_Nubjub_A, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_04_12;)