alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO EXE - Served Inline HTTP"; flow:to_client,established; http.header; content:"Content-Disposition"; nocase; content:"inline"; nocase; file.data; content:"MZ"; depth:2; fast_pattern; classtype:misc-activity; sid:2014519; rev:8; metadata:created_at 2012_04_06, confidence High, signature_severity Informational, updated_at 2020_08_03;)