alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO Windows Update/Microsoft FP Flowbit M4"; flow:established,to_server; flowbits:set,ET.INFO.WindowsUpdate; flowbits:noalert; http.method; content:"GET"; http.uri; content:"cacheHostOrigin="; fast_pattern; pcre:"/(?:^|\x2e)(?:windowsupdate\x2ecom|update\x2emicrosoft\x2ecom|delivery\x2emp\x2emicrosoft\x2ecom)$/R"; reference:url,techcommunity.microsoft.com/blog/windows-itpro-blog/microsoft-connected-cache-for-isps-microsoft%E2%80%99s-distributed-cdn/3891604; classtype:not-suspicious; sid:2059288; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, tls_state plaintext, created_at 2025_01_16, deployment Perimeter, performance_impact Low, confidence High, signature_severity Informational, tag windowsupdate, updated_at 2025_01_16;)