alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO PE EXE or DLL Windows file download HTTP"; flow:established,to_client; flowbits:isnotset,ET.http.binary; flowbits:isnotset,ET.INFO.WindowsUpdate; flowbits:set,ET.http.binary; file.data; content:"MZ"; within:2; byte_jump:4,58,relative,little; content:"PE|00 00|"; distance:-64; within:4; classtype:policy-violation; sid:2018959; rev:6; metadata:created_at 2014_08_19, confidence High, signature_severity Informational, updated_at 2024_03_14;)