alert smtp $EXTERNAL_NET any -> $SMTP_SERVERS any (msg:"ET INFO SMTP PDF Attachment Flowbit Set"; flow:established,from_server; content:"|0d 0a 0d 0a|JVBERi"; fast_pattern; flowbits:set,ET.pdf.in.smtp.attachment; flowbits:noalert; classtype:bad-unknown; sid:2024236; rev:3; metadata:attack_target SMTP_Server, created_at 2017_04_21, deployment Perimeter, confidence High, signature_severity Informational, updated_at 2019_10_08;)