alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET POLICY Possible EXE Download Request to ngrok"; flow:established,to_server; http.uri; content:".exe"; endswith; http.host; content:".ngrok.io"; endswith; fast_pattern; classtype:policy-violation; sid:2027391; rev:4; metadata:created_at 2019_05_28, deployment Perimeter, confidence Medium, signature_severity Major, tag Suspicious_Download, updated_at 2020_09_17;)