alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3890029)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/v0/b/june-july-dd5c8-91uk3/o/22mondaylincoln.txt|3f|alt=media|7c|26|7c|token=ce3b0c87-e670-4b32-940c-675bdc4fc8d2"; depth:114; endswith; nocase; http.host; content:"firebasestorage.googleapis.com"; depth:30; isdataat:!1,relative; metadata:created_at 2026_07_22; reference:url, urlhaus.abuse.ch/url/3890029/; classtype:trojan-activity; sid:84753129; rev:1;)