alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32.Blocker Checkin"; flow:established,to_server; http.uri; content:"/gate.php?cmd="; fast_pattern; content:"&botnet="; content:"&userid="; content:"&os="; reference:md5,1d8841128e63ed7e26200d4ed3bc8e05; classtype:command-and-control; sid:2014364; rev:3; metadata:created_at 2012_03_13, signature_severity Major, updated_at 2024_03_16;)