ET MALWARE Lurk Click fraud Template Request

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"ET MALWARE Lurk Click fraud Template Request";
    flow:to_server,established;
    http.request_line;
    content:"GET /log/"; fast_pattern; startswith;
    http.uri;
    content:"/?id=";
    pcre:"/^\/log\/[0-9]+\/[0-9]+\/\?id=[0-9]+$/";
    http.header_names;
    content:!"User-Agent|0d 0a|";
    content:!"Referer|0d 0a|";
    content:"Host|0d 0a|";
    reference:url,secureworks.com/cyber-threat-intelligence/threats/malware-analysis-of-the-lurk-downloader/;
    classtype:trojan-activity;
    sid:2018927; rev:3;
    metadata:created_at 2014_08_12, signature_severity Major, updated_at 2020_05_01;
)