alert http1 $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Generic Trojan with /? and Indy Library User-Agent"; flow:established,to_server; http.method; content:"GET"; nocase; http.uri; content:"/?"; startswith; http.header; content:"Indy Library)"; fast_pattern; content:"Accept-Encoding|3a 20|identity|0D 0A|User-Agent|3a 20|Mozilla/3.0 (compatible|3b 20|Indy Library)"; content:!".ensignsoftware.com"; classtype:trojan-activity; sid:2012312; rev:10; metadata:created_at 2011_02_14, confidence Medium, signature_severity Major, updated_at 2024_04_14;)