alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Possible Graftor Downloading Dridex"; flow:established,to_server; http.uri; content:".exe"; fast_pattern; pcre:"/^\/\d+\/\d+\.exe$/"; http.header; content:"Host|3a|"; depth:5; pcre:"/^Host\x3a[^\r\n]+\r\nAccept-Language\x3a[^\r\n]+\r\nAccept\x3a[^\r\n]+\r\nAccept-Encoding\x3a[^\r\n]+\r\nConnection\x3a\x20close\r\nUser-Agent\x3a[^\r\n]+\r\n(?:\r\n)?$/"; http.user_agent; content:"MSIE"; http.connection; content:"close"; bsize:5; http.header_names; content:!"Referer|0d 0a|"; reference:md5,5d9d5b9089ad464e51ff391b14da1953; classtype:trojan-activity; sid:2020960; rev:4; metadata:created_at 2015_04_22, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_09_30;)