ET MALWARE [PTsecurity] Win32/Spy.RTM/Redaman IP Check

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"ET MALWARE [PTsecurity] Win32/Spy.RTM/Redaman IP Check";
    flow:established, to_server;
    http.method;
    content:"GET";
    http.uri;
    content:"/index_small.php"; fast_pattern; endswith;
    http.header;
    content:"Cache-Control|3a 20|no-cache"; depth:24;
    content:"Connection|3a 20|Close"; within:19;
    content:"Pragma|3a 20|no-cache"; within:18;
    content:"Accept|3a 20|text/html, application/xhtml+xml, */*"; within:47;
    content:"Accept-Language|3a 20|en-US"; within:24;
    content:"Host|3a 20|"; within:8;
    isdataat:!35,relative;
    http.header_names;
    content:!"Referer|0d 0a|";
    content:!"User-Agent|0d 0a|";
    classtype:trojan-activity;
    sid:2027025; rev:3;
    metadata:created_at 2019_03_04, malware_family Win32_Spy_RTM_Redaman, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_08_27;
)