ET POLICY PE EXE or DLL Windows file download HTTP

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"ET POLICY PE EXE or DLL Windows file download HTTP";
    flow:established,to_client;
    flowbits:isnotset,ET.http.binary;
    flowbits:isnotset,ET.INFO.WindowsUpdate;
    file_data;
    content:"MZ"; within:2;
    byte_jump:4,58,relative,little;
    content:"PE|00 00|"; distance:-64; within:4;
    flowbits:set,ET.http.binary;
    classtype:policy-violation;
    sid:2018959; rev:5;
    metadata:created_at 2014_08_19, confidence High, signature_severity Informational, updated_at 2025_01_16;
)