alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET HUNTING Terse Named Filename EXE Download - Possibly Hostile"; flow:established,to_client; http.header; content:"filename="; content:".exe"; within:8; fast_pattern; pcre:"/filename\x3d[\x27\x22][a-z0-9]{1,3}\x2Eexe/i"; classtype:suspicious-filename-detect; sid:2020202; rev:5; metadata:attack_target Client_and_Server, created_at 2015_01_16, deployment Perimeter, deployment SSLDecrypt, deployment alert_only, performance_impact Moderate, confidence Low, signature_severity Informational, updated_at 2023_05_24; target:dest_ip;)