alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET HUNTING SUSPICIOUS *.doc.exe in HTTP HEADER"; flow:from_server,established; http.header; content:"Content-Disposition|3a| attachment|3b| filename="; nocase; content:".doc.exe"; nocase; distance:0; fast_pattern; classtype:bad-unknown; sid:2013477; rev:10; metadata:created_at 2011_08_26, confidence Medium, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_04_21;)