alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO EXE - Served Inline HTTP"; flow:established,to_client; http.header; content:"Content-Disposition"; nocase; content:"inline"; nocase; file.data; content:"MZ"; startswith; fast_pattern; classtype:misc-activity; sid:2014519; rev:10; metadata:created_at 2012_04_06, confidence High, signature_severity Informational, updated_at 2024_04_13;)