alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET HUNTING bmp File Request Returning Encoded File"; flow:established,to_client; flowbits:isset,ET.bmp_seen; http.stat_code; content:"200"; http.content_type; content:"image/bmp"; http.content_len; byte_test:0,>,450000,0,string,dec; file.data; content:"=="; startswith; fast_pattern; pcre:"/^[A-Za-z0-9+/]{180}/R"; classtype:bad-unknown; sid:2050073; rev:1; metadata:attack_target Client_Endpoint, created_at 2024_01_16, deployment Perimeter, performance_impact Low, confidence Medium, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_01_16; target:dest_ip;)