alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3893290)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/my-files/5.msi|3f|x-amz-algorithm=aws4-hmac-sha256|7c|26|7c|x-amz-credential=6483d30e4e635518dc3375a0d3ab56a6/20260727/auto/s3/aws4_request|7c|26|7c|x-amz-date=20260727t191829z|7c|26|7c|x-amz-expires=604800|7c|26|7c|x-amz-signedheaders=host|7c|26|7c|x-amz-signature=a9992d87e82deb0062b4299448b1050236e325aeaef616a16debb9690a8ca832"; depth:331; endswith; nocase; http.host; content:"1d2ef215ce65986951fe48e70c16d6d4.r2.cloudflarestorage.com"; depth:57; isdataat:!1,relative; metadata:created_at 2026_07_29; reference:url, urlhaus.abuse.ch/url/3893290/; classtype:trojan-activity; sid:84756390; rev:1;)