ET EXPLOIT Possible Magento Directory Traversal Attempt

alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (
    msg:"ET EXPLOIT Possible Magento Directory Traversal Attempt";
    flow:established,to_server;
    http.method;
    content:"GET";
    http.uri;
    content:"/magmi-importer/web/"; fast_pattern;
    content:"download_file.php?file="; distance:0;
    http.uri.raw;
    content:"|2e 2e 2f|";
    http.header_names;
    content:!"Referer|0d 0a|";
    reference:url,threatpost.com/zero-day-in-magento-plugin-magmi-under-attack/115026/;
    classtype:trojan-activity;
    sid:2021951; rev:3;
    metadata:created_at 2015_10_15, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, updated_at 2020_06_04, mitre_tactic_id TA0007, mitre_tactic_name Discovery, mitre_technique_id T1083, mitre_technique_name File_And_Directory_Discovery;
    target:dest_ip;
)