alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Dorkbot Loader Payload Request"; flow:established,to_server; urilen:<11; http.uri; content:".exe"; fast_pattern; http.header; content:"Mozilla/4.0|0D 0A|Host|3a|"; reference:md5,3452c20fd0df69ccfdea520a6515208a; classtype:trojan-activity; sid:2016578; rev:6; metadata:created_at 2013_03_15, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_04_29;)