alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Possible Dridex Download URI Struct with no referer"; flow:established,to_server; http.method; content:"GET"; http.uri; pcre:"/\/\d+\/\d+\.exe$/"; http.user_agent; content:!"LogitechUpdate"; depth:14; http.request_line; content:".exe HTTP/1."; fast_pattern; http.header_names; content:!"Referer|0d 0a|"; content:!"Accept-Language|0d 0a|"; content:!"Cookie|0d 0a|"; classtype:trojan-activity; sid:2021245; rev:10; metadata:created_at 2015_06_10, performance_impact Moderate, confidence Medium, signature_severity Major, updated_at 2024_04_08;)