alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Possible Locky JS Downloading Payload"; flow:established,to_server; flowbits:set,ET.Locky; flowbits:noalert; urilen:<12; http.method; content:"GET"; http.uri; pcre:"/^\/(?=[a-z]{0,9}?\d)(?=\d{0,9}?[a-z])[a-z0-9]{6,10}$/"; http.header; header_lowercase; content:"accept|3a 20 2a 2f 2a 0d 0a|accept-encoding|3a 20|gzip|2c 20|deflate|0d 0a|"; fast_pattern; http.user_agent; pcre:"/(?:MSIE|rv\x3a11)/"; http.header_names; to_lowercase; content:!"|0d 0a|referer|0d 0a|"; reference:md5,c6896184db5c07ebadf40115138b2f4c; reference:md5,cb8f78317622f8ae855ac25ef4cf3688; classtype:trojan-activity; sid:2026460; rev:6; metadata:created_at 2016_03_16, confidence Medium, signature_severity Major, updated_at 2024_04_29;)