alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO Adobe PKG Download Flowbit Set"; flow:established,to_server; flowbits:set,ET.Adobe.Site.Download; flowbits:noalert; http.uri; content:"pkg"; http.host; bsize:20; content:"platformdl.adobe.com"; classtype:misc-activity; sid:2017294; rev:5; metadata:created_at 2013_08_07, confidence High, signature_severity Informational, updated_at 2024_03_24;)