alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3848520)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/scl/fi/ex1a1fllyh1s9btieeqn6/sq469eehw8ty.exe|3f|rlkey=igsxdnz60e4j9awr87sfdq6tf|7c|26|7c|st=ox0brfwh|7c|26|7c|dl=0https://www.dropbox.com/scl/fi/ex1a1fllyh1s9btieeqn6/sq469eehw8ty.exe|3f|rlkey=igsxdnz60e4j9awr87sfdq6tf|7c|26|7c|st=ox0brfwh|7c|26|7c|dl=1"; depth:255; endswith; nocase; http.host; content:"www.dropbox.com"; depth:15; isdataat:!1,relative; metadata:created_at 2026_05_17; reference:url, urlhaus.abuse.ch/url/3848520/; classtype:trojan-activity; sid:84711620; rev:1;)