alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS Fake Google Chrome Update/Install"; flow:established,to_server; http.uri; content:"/chrome/google_chrome_"; fast_pattern; content:".exe"; endswith; pcre:"/\/chrome\/google_chrome_(update|installer)\.exe$/"; reference:url,www.barracudanetworks.com/blogs/labsblog?bid=3108; reference:url,www.bluecoat.com/security-blog/2012-12-05/blackhole-kit-doesnt-chrome; classtype:trojan-activity; sid:2015997; rev:4; metadata:created_at 2012_12_06, signature_severity Major, updated_at 2024_03_17;)