alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE StealRat Checkin"; flow:established,to_server; http.uri; content:"/d/"; startswith; fast_pattern; content:".jpg"; endswith; pcre:"/^\/d\/[a-z]+\d+\.jpg$/"; http.header_names; to_lowercase; content:!"|0d 0a|referer|0d 0a|"; http.host; bsize:14; content:"www.google.com"; classtype:command-and-control; sid:2017263; rev:7; metadata:created_at 2013_08_01, deprecation_reason Age, signature_severity Major, updated_at 2024_04_20, reviewed_at 2024_02_08;)