ET MALWARE DustySky Payload Link Request

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"ET MALWARE DustySky Payload Link Request";
    flow:established,to_server;
    http.method;
    content:"GET";
    http.uri;
    content:".php?id="; fast_pattern;
    content:"&token1="; distance:0;
    content:"&token2="; distance:0;
    content:"&C="; distance:0;
    pcre:"/\/[A-Za-z]+\.php\?((?:id|token1|token2|C)=[A-Za-z0-9\/=+%]*={0,2}&?){4}$/";
    http.header_names;
    content:!"Referer|0d 0a|";
    reference:url,www.clearskysec.com/wp-content/uploads/2016/01/Operation%20DustySky_TLP_WHITE.pdf;
    classtype:trojan-activity;
    sid:2022343; rev:3;
    metadata:created_at 2016_01_08, confidence High, signature_severity Major, updated_at 2020_06_17;
)