ET MALWARE Win32/Poweliks.A Checkin 2

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"ET MALWARE Win32/Poweliks.A Checkin 2";
    flow:established,to_server;
    threshold:type limit, track by_src, seconds 60, count 1;
    http.method;
    content:"GET";
    http.uri;
    content:"/query?version="; fast_pattern;
    content:"&sid=";
    content:"&builddate="; distance:0;
    content:"&q="; distance:0;
    content:"&ua=";
    content:"&lang=";
    content:"&wt=";
    content:"&lr="; distance:0;
    content:"&ls="; distance:0;
    http.header_names;
    content:!"User-Agent|0d 0a|";
    content:!"Accept";
    content:!"Referer|0d 0a|";
    classtype:command-and-control;
    sid:2019966; rev:4;
    metadata:created_at 2014_12_18, malware_family Win32_Poweliks_A, signature_severity Major, updated_at 2020_09_28;
)