alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Trojan/MSIL.bfsx Checkin"; flow:established,to_server; http.uri; content:"/infect"; fast_pattern; content:".php"; offset:7; pcre:"/\/infect(?:-\d)?\.php$/"; http.user_agent; bsize:9; content:"Microsoft"; reference:md5,506cd65bdd06f41f8219cd1ed78eac7d; reference:md5,0c39b39ee4a59a8ac5fc1df500da2a88; classtype:command-and-control; sid:2019840; rev:8; metadata:created_at 2014_12_03, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_27;)