alert tcp any any -> any any (msg:"🐾 - ☣ Download request 🌐 Dridex trojan ♞"; flow:to_server, stateless; content:"GET"; content:"/opxe.exe"; content:"urefere.org"; fast_pattern; reference:url,https://www.cert.ssi.gouv.fr/ioc/CERTFR-2020-IOC-003/; reference:url,https://malpedia.caad.fkie.fraunhofer.de/details/win.dridex; sid:3306794; metadata:created_at 2020_06_29, updated_at 2020_06_29; rev:1; classtype:trojan-activity;)