alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE RansomCrypt Getting Template"; flow:established,to_server; http.uri; content:"/lnd/template="; fast_pattern; pcre:"/\/[a-z0-9]+$/i"; http.user_agent; content:"MSIE 7.0|3b 20|Windows NT 5.1|3b|"; classtype:trojan-activity; sid:2016749; rev:4; metadata:created_at 2013_04_10, signature_severity Major, updated_at 2024_03_06;)