#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "BLEEDING-EDGE TROJAN Webber/Berbew Trojan keystroke log upload"; flow: established; content:"id=crutop|26|vvpupkin0="; depth: 20; reference:url,www.lurhq.com/berbew.html; classtype: trojan-activity; sid: 2001303; rev:4; )