alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET INFO Generic HTTP EXE Upload Inbound"; flow:established,to_server; http.method; content:"POST"; nocase; http.request_body; content:"MZ"; content:"|00 00 00 00|"; distance:0; content:"PE|00 00|"; fast_pattern; distance:0; classtype:misc-activity; sid:2016774; rev:3; metadata:created_at 2013_04_19, confidence Medium, signature_severity Informational, updated_at 2020_04_23;)