alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO Dropbox paper Document Request Observed"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/scl/fi/"; startswith; pcre:"/^[a-zA-Z0-9]{21}\//R"; content:".paper|3f|rlkey|3d|"; fast_pattern; pcre:"/^[a-zA-Z0-9]{21}/R"; http.host; bsize:15; content:"www.dropbox.com"; classtype:misc-activity; sid:2052813; rev:2; metadata:affected_product Any, attack_target Client_Endpoint, tls_state TLSDecrypt, created_at 2024_05_21, deployment Perimeter, deployment SSLDecrypt, performance_impact Low, confidence High, signature_severity Informational, tag TA_Abused_Service, updated_at 2026_01_20; target:src_ip;)