title: snort rule: logging access to site containing the word "Malware"
body: <p>I am trying to create a rule for snort to basically log any packets once a user tries to access a page with the word "malware" in it. This is what I have, just asking for some guide. So basically once a webpage contains the phrase it shows an alert.</p>
  
  <pre><code> alert tcp any any -&gt; any any
   (content:"malware";
    msg:"Someone clone is accessing a page with malware tagged!!!!";
    aid:10000002;rev:1;)
  </code></pre>