alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Yandexbot Request Outbound"; flow:established,to_server; http.user_agent; content:"YandexBot"; startswith; classtype:trojan-activity; sid:2013254; rev:5; metadata:attack_target Web_Server, created_at 2011_07_12, deployment Perimeter, signature_severity Minor, tag WebCrawler, updated_at 2024_04_13, mitre_tactic_id TA0043, mitre_tactic_name Reconnaissance, mitre_technique_id T1593, mitre_technique_name Search_Open_Websites;)