alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - 👀 HTTP direct request to public IP address 🌐"; flow:established,to_server; http.host.raw; pcre:"/^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/"; http.uri; content:!"microsoft.com"; endswith; content:!"windowsupdate.com"; fast_pattern; endswith; content:!"office.net"; endswith; metadata:created_at 2022_12_07, updated_at 2024_02_19; sid:3300700; rev:5; classtype:bad-unknown;)