alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET HUNTING SUSPICIOUS *.doc.exe in HTTP HEADER"; flow:established,to_client; http.header; header_lowercase; content:"content-disposition|3a 20|attachment|3b 20|filename="; nocase; content:".doc.exe"; nocase; distance:0; fast_pattern; classtype:bad-unknown; sid:2013477; rev:13; metadata:created_at 2011_08_26, confidence Medium, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_05_06;)