alert http any any -> $HOME_NET any (msg:"ET EXPLOIT Known Malicious Router DNS Change GET Request"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/router/add_dhcp_segment.cgi?"; fast_pattern; content:"is_router_as_dns=1"; content:"&dns1="; content:"submitbutton="; reference:url,wepawet.cs.ucsb.edu/view.php?hash=5e14985415814ed1e107c0583a27a1a2&t=1384961238&type=js; classtype:attempted-admin; sid:2020877; rev:5; metadata:created_at 2015_04_09, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_06;)