alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Steganographic Encoded WAV File Inbound via HTTP M2"; flow:established,from_server; http.stat_code; content:"200"; file.data; content:"RIFF"; startswith; content:"WAVE"; distance:4; within:4; content:"|5C 99 13 6F F2 52|"; distance:32; within:6; fast_pattern; reference:url,threatvector.cylance.com/en_us/home/malicious-payloads-hiding-beneath-the-wav.html; classtype:trojan-activity; sid:2028877; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, created_at 2019_10_18, deployment Perimeter, performance_impact Low, confidence Medium, signature_severity Major, updated_at 2020_10_20;)