ET MALWARE Dooptroop Dropper Checkin

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"ET MALWARE Dooptroop Dropper Checkin";
    flow:established,to_server;
    http.method;
    content:"GET";
    http.uri;
    content:"/nconfirm.php?"; fast_pattern;
    content:"rev="; distance:0;
    content:"code=";
    content:"param=";
    content:"num=";
    http.header_names;
    content:!"Referer|0d 0a|";
    reference:url,blog.eset.com/2012/03/17/drive-by-ftp-a-new-view-of-cve-2011-3544;
    classtype:command-and-control;
    sid:2013808; rev:5;
    metadata:created_at 2011_04_07, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_08_03;
)