alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE VBS/TrojanDownloader.Agent.XAO Payload Inbound"; flow:established,to_client; http.content_type; content:"application/hta"; http.response_body; content:"|3c|html|20|xmlns|3d 22|http|3a 2f 2f|www|2e|w3|2e|org|2f|1999|2f|xhtml|22 3e 0a 3c|head|3e 0a 3c|meta|20|content|3d 22|text|2f|html|3b 20|charset|3d|utf|2d|8|22 20|http|2d|equiv|3d 22|Content|2d|Type|22 20 2f 3e 0a 3c|script|20|language|3d 22|VBScript|22 3e 0a|Function|20|"; startswith; fast_pattern; pcre:"/(?:[a-zA-Z]{10,20})\x28\x29/R"; content:"|0a|Dim|20|"; reference:md5,0627702978f544eed9dd2cb0e876bba7; reference:md5,3253c1ecf5312f6d863176f195d47d38; classtype:trojan-activity; sid:2044909; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2023_04_07, deployment Perimeter, malware_family VBS_TrojanDownloader_Agent_XAO, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2023_04_19;)