ET MALWARE Win32/Spy.Tuscas

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"ET MALWARE Win32/Spy.Tuscas";
    flow:established,to_server;
    http.uri;
    content:"?version="; fast_pattern;
    content:"&group=";
    content:"&client=";
    content:"&computer=";
    content:"&os=";
    content:"&latency=";
    http.header_names;
    content:!"Accept";
    content:!"Referer|0d 0a|";
    reference:url,stopmalvertising.com/malware-reports/analysis-of-tuscas.html;
    classtype:trojan-activity;
    sid:2018999; rev:4;
    metadata:created_at 2014_08_25, malware_family Win32_Spy_Tuscas, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_09_25;
)