alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P Possible Torrent Download via HTTP Request"; flow:established,to_server; http.uri; content:".torrent"; nocase; endswith; http.host; content:!"mapfactor.com"; content:!"verismic.blob.core.windows.net"; classtype:policy-violation; sid:2007727; rev:12; metadata:created_at 2010_07_30, confidence Medium, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2022_11_21, reviewed_at 2024_05_01;)