alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Scalaxy Jar file"; flow:established,to_client; flowbits:isset,ET.http.javaclient.vulnerable; file.data; content:"PK"; startswith; content:"C1.class"; fast_pattern; distance:0; content:"C2.class"; distance:0; classtype:trojan-activity; sid:2014983; rev:6; metadata:created_at 2012_06_29, signature_severity Informational, updated_at 2024_04_14;)