alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3848415)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/993c80f8-6c83-4e31-ada5-a6a89e13b6ea/google.ct"; depth:47; endswith; nocase; http.host; content:"gardenworkflowcenter.garden"; depth:27; isdataat:!1,relative; metadata:created_at 2026_05_16; reference:url, urlhaus.abuse.ch/url/3848415/; classtype:trojan-activity; sid:84711515; rev:1;)