alert http1 $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Possible Kelihos.F EXE Download Common Structure"; flow:established,to_server; urilen:12; http.method; content:"GET"; http.uri; content:".exe"; fast_pattern; pcre:"/^(?:\/[a-z]+\d*?)?\/\d?\w+\d*?\.exe$/"; http.host; pcre:"/^(?:\d{1,3}\.){3}\d{1,3}$/"; http.header_names; content:"|0d 0a|Host|0d 0a 0d 0a|"; startswith; endswith; reference:md5,f5bcc28e7868a68e473373d684a8c54a; classtype:trojan-activity; sid:2017598; rev:14; metadata:created_at 2013_10_15, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_04_14;)