alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Citadel API Access VNC Controller (Outbound)"; flow:established,to_server; http.uri; content:"/api.php/"; fast_pattern; content:"/vnc/"; nocase; content:"botI"; nocase; reference:url,xylithreats.free.fr/public/; reference:url,www.xylibox.com/2012/10/citadel-1351-rain-edition.html; classtype:trojan-activity; sid:2015829; rev:7; metadata:created_at 2012_10_23, signature_severity Major, updated_at 2024_03_17;)