alert http any any -> $HOME_NET any (msg:"ET EXPLOIT Java runtime.exec() call"; flow:established,to_client; file.data; content:"|52 75 6e 74 69 6d 65 3b 01 00 04 65 78 65 63 01 00|"; reference:url,www.mullingsecurity.com; classtype:trojan-activity; sid:2002783; rev:6; metadata:created_at 2010_07_30, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_04_11;)