ET MALWARE Win32.Glupteba/ClIEcker CnC Checkin

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"ET MALWARE Win32.Glupteba/ClIEcker CnC Checkin";
    flow:established,to_server;
    http.uri;
    content:"&downlink=";
    content:"&uplink=";
    content:"&id=";
    content:"&statpass="; fast_pattern;
    content:"&version=";
    content:"&features=";
    content:"&guid=";
    content:"&comment=";
    reference:url,blog.eset.com/2011/03/02/tdl4-and-glubteba-piggyback-piggybugs;
    classtype:command-and-control;
    sid:2013293; rev:7;
    metadata:created_at 2011_07_19, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_11_19;
)