alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE W32/DirtJumper CnC Server Providing DDOS Targets"; flow:established,to_client; file.data; content:"|7C|"; fast_pattern; offset:2; depth:1; content:"|7c|"; distance:2; within:4; content:"http|3A 2F 2F|"; distance:3; within:7; pcre:"/\d{2}\x7C\d{1,3}\x7C\d{1,3}http\x3A\x2F\x2F/Ai"; reference:url,asert.arbornetworks.com/2011/08/dirt-jumper-caught/; classtype:command-and-control; sid:2013440; rev:9; metadata:created_at 2011_08_19, signature_severity Major, updated_at 2024_04_09;)