ET MALWARE Win32/Cryptrun.B Connectivity check

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"ET MALWARE Win32/Cryptrun.B Connectivity check";
    flow:from_client,established;
    http.method;
    content:"GET";
    http.uri;
    content:"/search?qu="; fast_pattern;
    http.header;
    content:"Content-Length|3a 20|4|0D 0A|";
    http.user_agent;
    content:"Firefox/2.0.0.2"; depth:15; endswith;
    http.host;
    content:"www.google.com"; distance:0; bsize:14;
    reference:url,blog.9bplus.com/kim-jong-il-pdf-malware;
    classtype:trojan-activity;
    sid:2014173; rev:5;
    metadata:created_at 2012_01_31, malware_family Win32_Cryptrun_B, signature_severity Major, updated_at 2020_10_13;
)