alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Fake AV Phone Scam Stylesheet June 26 2015"; flow:established,to_client; http.content_type; content:"text/css"; startswith; file.data; content:".header-warning"; content:".what-to-do"; distance:0; content:"more-about-the-virus"; distance:0; fast_pattern; classtype:social-engineering; sid:2021366; rev:4; metadata:created_at 2015_06_29, confidence High, signature_severity Minor, updated_at 2024_03_02;)