alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO JAR Size Under 30K Size - Potentially Hostile"; flow:established,to_client; http.content_type; content:"application/java-archive"; depth:24; fast_pattern; http.content_len; byte_test:0,<=,30000,0,string,dec; file.data; content:"PK"; within:2; classtype:bad-unknown; sid:2017639; rev:8; metadata:created_at 2013_10_28, confidence High, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_08_20;)