alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO Executable Downloaded from Google Cloud Storage"; flow:established,to_client; http.header_names; to_lowercase; content:"|0d 0a|x-goog-generation|0d 0a|"; fast_pattern; content:"|0d 0a|x-goog-metageneration|0d 0a|"; content:"|0d 0a|x-goog-stored-content-encoding|0d 0a|"; content:"|0d 0a|x-goog-stored-content-length|0d 0a|"; content:"|0d 0a|x-goog-hash|0d 0a|"; file.data; content:"MZ"; within:2; reference:md5,e742e844d0ea55ef9f1c68491c702120; classtype:misc-activity; sid:2021216; rev:6; metadata:created_at 2015_06_09, deployment Perimeter, confidence High, signature_severity Informational, updated_at 2024_04_07;)