alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Spam Campaign JPG CnC Link"; flow:established,to_client; file_data; content:"he1l0|3A|hxxp|3A|//"; distance:0; content:".jpg"; distance:0; reference:url,blog.fireeye.com/research/2012/11/more-phish.html; classtype:command-and-control; sid:2015921; rev:2; metadata:created_at 2012_11_21, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2019_07_26;)