alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO MPEG Download Over HTTP (1)"; flow:established,to_client; flowbits:set,ET.mpeg.HTTP; flowbits:noalert; file.data; content:"|00 00 01 ba|"; startswith; classtype:not-suspicious; sid:2016404; rev:6; metadata:created_at 2013_02_12, confidence High, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_04_14;)