alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Trojan.BAT.Qhost - SET"; flow:established,to_server; flowbits:set,ETPRO.Trojan.BAT.Qhost; flowbits:noalert; http.method; content:"GET"; http.uri; content:"/stat/tuk/"; fast_pattern; reference:md5,f6e1583aca310c4c0d55db1dae942b2b; classtype:trojan-activity; sid:2014758; rev:7; metadata:created_at 2012_05_16, signature_severity Major, updated_at 2024_03_17;)