alert http1 $HOME_NET any -> $EXTERNAL_NET 8080 (msg:"ET MALWARE Trojan-GameThief.Win32.OnLineGames.bnye Checkin"; flow:established,to_server; http.protocol; content:"HTTP/1.1"; http.user_agent; pcre:"/[a-z]{3,4}/"; http.host.raw; content:"|3a|8080"; endswith; fast_pattern; http.header_names; bsize:37; content:!"|0d 0a|Accept"; content:"|0d 0a|User-Agent|0d 0a|Host|0d 0a|Cache-Control|0d 0a 0d 0a|"; reference:md5,014945cf93ffc94833f7a3efd92fe263; classtype:command-and-control; sid:2012736; rev:13; metadata:created_at 2011_04_28, deprecation_reason Relevance, performance_impact Significant, signature_severity Major, updated_at 2024_04_09;)