alert smtp $EXTERNAL_NET any -> $SMTP_SERVERS any (msg:"ET INFO SMTP PDF Attachment Flowbit Set"; flow:established,to_client; flowbits:set,ET.pdf.in.smtp.attachment; flowbits:noalert; content:"|0d 0a 0d 0a|JVBERi"; fast_pattern; classtype:bad-unknown; sid:2024236; rev:5; metadata:attack_target SMTP_Server, created_at 2017_04_21, deployment Perimeter, confidence High, signature_severity Informational, updated_at 2024_03_14;)