alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3879004)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/sso.esic.gov.inesicssoappliferaylogin.jspbmctx=7cad769bfa3451be21de1f73e125d2c4fa94907f3fe40a1dce0db069c1a208e4|7c|26|7c|password=secure_string|7c|26|7c|contexttypeop.php"; depth:171; endswith; nocase; http.host; content:"107.173.143.45"; depth:14; isdataat:!1,relative; metadata:created_at 2026_07_01; reference:url, urlhaus.abuse.ch/url/3879004/; classtype:trojan-activity; sid:84742104; rev:1;)