alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Dridex Base64 Executable"; flow:established,to_client; http.stat_code; content:"200"; http.cookie; content:"|47 4f 44 5a 49 4c 4c 41|"; file.data; content:"<div style=|22|display|3a|none|22 20|id=|22|"; startswith; fast_pattern; pcre:"/^(?P<id>[a-z])\x22\sname=\x22(?P=id)\x22>TVqQAA/Rsi"; classtype:trojan-activity; sid:2022595; rev:5; metadata:created_at 2016_03_05, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_04_13;)