alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Zbot download config"; flow:established,from_server; flowbits:isset,ET.zbot.dat; http.stat_code; content:"200"; http.stat_msg; content:"OK"; http.content_type; content:"application/x-ns-proxy-autoconfig"; fast_pattern; startswith; file.data; pcre:"/^(?=[a-zA-Z]*?\d)(?=[a-z0-9]*?[A-Z])[a-zA-Z0-9+/]{30}/R"; classtype:trojan-activity; sid:2022318; rev:4; metadata:created_at 2015_12_30, signature_severity Major, updated_at 2020_06_17;)