alert http $HOME_NET any -> $EXTERNAL_NET [8000,8003,9004:] (msg:"ET MALWARE W32Autorun.worm.aaeh Checkin"; flow:established,to_server; http.host; content:"ns1.help"; fast_pattern; startswith; pcre:"/^(?:update(?:d\.(?:com?|net?|org?)|k\.(?:at?|eu?|tw)|r\.net|s\.com)|checks\.net)/R"; reference:url,www.mcafee.com/threat-intelligence/malware/default.aspx?id=1607456; classtype:command-and-control; sid:2019711; rev:5; metadata:created_at 2014_11_15, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_24;)