alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Steganographic Encoded WAV File Inbound via HTTP M1"; flow:established,from_server; http.stat_code; content:"200"; file.data; content:"RIFF"; startswith; content:"WAVE"; distance:4; within:4; content:"|0B 87 06 53 DF 3A|"; distance:32; within:6; fast_pattern; reference:url,threatvector.cylance.com/en_us/home/malicious-payloads-hiding-beneath-the-wav.html; classtype:trojan-activity; sid:2028876; rev:2; metadata:created_at 2019_10_18, deployment Perimeter, performance_impact Low, confidence Medium, signature_severity Major, updated_at 2020_10_20;)