alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Trojan.BAT.Qhost Response from Controller"; flow:established,to_client; flowbits:isset,ETPRO.Trojan.BAT.Qhost; http.cookie; content:"ci_session="; content:"session_id"; distance:0; content:"ip_address"; distance:0; content:"user_agent"; fast_pattern; distance:0; content:"last_activity"; distance:0; content:"user_data"; distance:0; reference:md5,f6e1583aca310c4c0d55db1dae942b2b; classtype:trojan-activity; sid:2014759; rev:6; metadata:created_at 2012_05_16, signature_severity Major, updated_at 2024_04_08;)