alert http1 $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Potential Dridex.Maldoc Minimal Executable Request"; flow:established,to_server; urilen:<15; http.method; content:"GET"; http.uri; content:".exe"; endswith; fast_pattern; pcre:"/^\/\d+\/\d+\.exe$/"; http.header; pcre:"/^Host\x3a[^\r\n]+\r\n(?:(?:Cache-Control|Pragma)\x3a[^\r\n]+\r\n)?(?:\r\n)?$/mi"; http.header_names; content:!"|0d 0a|User-Agent|0d 0a|"; content:!"|0d 0a|Accept"; content:!"|0d 0a|Referer|0d 0a|"; content:"|0d 0a|Host|0d 0a|"; startswith; pcre:"/^(?:(?:Cache-Control|Pragma)\x0d\x0a)?\x0d\x0a$/R"; reference:md5,2cea5182d71b768e8b669cacdea39825; classtype:trojan-activity; sid:2020941; rev:7; metadata:created_at 2015_04_17, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_04_07;)