alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE ELF_BASHLITE.SMB Dropping Files"; flow:established,to_server; http.uri; content:"/.ni|67 67|ers/bin"; fast_pattern; content:".sh"; within:5; http.user_agent; content:"Wget/"; depth:5; reference:url,blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/; classtype:trojan-activity; sid:2019747; rev:5; metadata:created_at 2014_11_19, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_08_19;)