alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Script/Executable Downloaded from Filelu"; flow:established,to_server; http.method; content:"GET"; http.uri; pcre:"/\x2e(?:js|vba|vbs|exe|dll|hta|ps1|bat)/"; http.host; content:"filelu"; fast_pattern; reference:md5,18f3b8a9d9bc8369d73ff8daa9fa494c; classtype:misc-activity; sid:2071909; rev:2; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, tls_state TLSDecrypt, created_at 2026_09_02, deployment Perimeter, deployment SSLDecrypt, confidence High, signature_severity Informational, updated_at 2026_09_03, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1105, mitre_technique_name Ingress_Tool_Transfer; target:src_ip;)