alert http1 $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Zeus/Aeausuc P2P Variant Retrieving Peers List"; flow:established,to_server; http.method; content:"POST"; nocase; http.uri; content:"/gameover"; content:".php"; pcre:"/gameover(\d+)?\.php/"; http.protocol; content:"HTTP/1.1"; http.accept; bsize:3; content:"*/*"; http.header_names; content:"|0d 0a|Accept|0d 0a|X-ID|0d 0a|"; fast_pattern; startswith; reference:url,www.abuse.ch/?p=3499; classtype:trojan-activity; sid:2013740; rev:11; metadata:created_at 2011_10_05, signature_severity Major, updated_at 2024_04_08;)