alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO Adobe PKG Download Flowbit Set"; flow:established,to_server; flowbits:set,ET.Adobe.Site.Download; flowbits:noalert; http.uri; content:"pkg"; http.host; content:"platformdl.adobe.com"; bsize:20; classtype:misc-activity; sid:2017294; rev:4; metadata:created_at 2013_08_07, confidence High, signature_severity Informational, updated_at 2020_04_24;)