alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3902613)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/dl|3f|%7b%22f%22%3a%22xr%22%2c%22t%22%3a%22b%22%2c%22p%22%3a%22lnx%22%2c%22a%22%3a%2264%22%2c%22e%22%3a%22aes%22%2c%22c%22%3a1%7d"; depth:130; endswith; nocase; http.host; content:"apt-update.com"; depth:14; isdataat:!1,relative; metadata:created_at 2026_08_12; reference:url, urlhaus.abuse.ch/url/3902613/; classtype:trojan-activity; sid:84765713; rev:1;)