alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Possible Locky JS Downloading Payload"; flow:established,to_server; urilen:<12; flowbits:set,ET.Locky; flowbits:noalert; http.method; content:"GET"; http.uri; pcre:"/^\/(?=[a-z]{0,9}?\d)(?=\d{0,9}?[a-z])[a-z0-9]{6,10}$/"; http.header; content:"Accept|3a 20|*/*|0d 0a|Accept-Encoding|3a 20|gzip, deflate|0d 0a|"; fast_pattern; http.user_agent; pcre:"/(?:MSIE|rv\x3a11)/"; http.header_names; content:!"|0d 0a|Referer|0d 0a|"; reference:md5,c6896184db5c07ebadf40115138b2f4c; reference:md5,cb8f78317622f8ae855ac25ef4cf3688; classtype:trojan-activity; sid:2026460; rev:4; metadata:created_at 2016_03_16, confidence Medium, signature_severity Major, updated_at 2024_02_27;)