alert http any any -> $HOME_NET any (msg:"ET HUNTING Win32/BROOXML OOXML File Format Inbound"; flow:established,to_client; flowbits:isset,ET.brooxml; http.response_body; content:"|50 4b 03 04|"; offset:4; content:"|13 00|"; distance:22; within:2; content:"[Content_Types].xml"; distance:2; within:19; content:"word/document.xml"; fast_pattern; reference:md5,d3c1e1d6abf3a534dea2f6ff04fe153b; classtype:bad-unknown; sid:2057738; rev:1; metadata:attack_target Client_Endpoint, created_at 2024_11_20, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_11_20; target:dest_ip;)