alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING GET MSP360 .exe from AWS"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/MBS"; content:"Source/MultiBrands/"; fast_pattern; distance:0; content:".exe"; distance:0; http.host; content:"amazonaws.com"; endswith; classtype:misc-activity; sid:2067835; rev:1; metadata:created_at 2026_02_18, signature_severity Unknown, tag RMM, tag MSP360, updated_at 2026_02_18;)