alert http $HOME_NET any -> $EXTERNAL_NET any (
msg:"ET WEB_CLIENT VLC Media Player Aegisub Advanced SubStation (.ass) File Request flowbit set";
flow:established,to_server;
flowbits:set,ET.ass.request;
flowbits:noalert;
http.uri;
content:".ass"; nocase;
classtype:not-suspicious;
sid:2010757; rev:8;
metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2020_09_10;
)