alert tcp $EXTERNAL_NET [445,139] -> $HOME_NET any (msg:"ET MALWARE Possible SandWorm INF Download (SMB)"; flow:to_client,established; content:"Software|5c|Microsoft|5c|Windows|5c|CurrentVersion|5c|Run"; nocase; content:"7EBEFBC0-3200-11d2-B4C2-00A0C9697D17"; fast_pattern; nocase; content:"ClassGuid"; nocase; content:"DefaultInstall"; nocase; classtype:attempted-user; sid:2019398; rev:2; metadata:created_at 2014_10_14, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2019_07_26;)