alert http any any -> $HOME_NET any (msg:"ET HUNTING Win32/BROOXML PDF File Format Inbound"; flow:established,to_client; flowbits:isset,ET.brooxml; http.response_body; content:"%PDF-"; offset:5; content:"|0a 25|"; distance:3; within:2; content:"|0a 31 20 30 20 6f 62 6a 0a|"; fast_pattern; distance:4; within:9; reference:md5,5b92e3c898e45780573b342102db112a; classtype:bad-unknown; sid:2057737; rev:1; metadata:attack_target Client_Endpoint, created_at 2024_11_20, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_11_20; target:dest_ip;)