alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Banker/Bancos/Infostealer Possible Rootkit - HTTP HEAD Request"; flow:established,to_server; http.method; content:"HEAD"; nocase; http.uri; content:".php?action="; fast_pattern; nocase; content:"&uid="; nocase; content:"&locale="; nocase; content:"&ver="; nocase; content:"&build="; nocase; reference:url,www.pctools.com/mrc/infections/id/Trojan.Banker/; reference:url,www.anti-spyware-101.com/remove-trojanbanker; classtype:trojan-activity; sid:2009750; rev:7; metadata:created_at 2010_07_30, malware_family Bancos, confidence Medium, signature_severity Major, tag Banking_Trojan, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_16;)