ET POLICY ICP Email Send via HTTP - Often Trojan Install Reports

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"ET POLICY ICP Email Send via HTTP - Often Trojan Install Reports";
    flow:established,to_server;
    http.uri;
    content:"/friendship/email_thank_you.php?"; nocase;
    content:"folder_id="; nocase;
    content:"&params_count="; nocase;
    content:"&nick_name="; nocase;
    content:"&user_email="; nocase;
    content:"&user_uin="; nocase;
    content:"&friend_nickname="; nocase;
    content:"&friend_contact="; nocase;
    classtype:policy-violation;
    sid:2008351; rev:5;
    metadata:created_at 2010_07_30, confidence High, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_04_20;
)