alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3852511)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/|3f|ublib=72a75cdb-387d-4b1c-ac11-92ad91b9e7f7"; depth:47; endswith; nocase; http.host; content:"fkmrx4nm.signal-meridian.digital"; depth:32; isdataat:!1,relative; metadata:created_at 2026_05_24; reference:url, urlhaus.abuse.ch/url/3852511/; classtype:trojan-activity; sid:84715611; rev:1;)