alert http1 $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE FakeAV FakeAlert.Rena or similar Checkin Flowbit Set 2"; flow:established,to_server; flowbits:set,ET.fakealert.rena.n; flowbits:noalert; http.uri; content:".php?id="; fast_pattern; pcre:"/^\d{2,4}$/R"; http.user_agent; content:"Mozilla"; startswith; http.header; content:"|0d 0a|Cache-Control|3a 20|no-cache|0d 0a|"; endswith; http.header_names; bsize:37; content:!"|0d 0a|Accept"; content:"|0d 0a|User-Agent|0d 0a|Host|0d 0a|Cache-Control|0d 0a 0d 0a|"; classtype:command-and-control; sid:2013419; rev:8; metadata:created_at 2011_08_18, signature_severity Major, updated_at 2024_04_09;)