ET MALWARE Possible click2play bypass Oct 19 2015 as observed in PawnStorm

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"ET MALWARE Possible click2play bypass Oct 19 2015 as observed in PawnStorm";
    flow:established,from_server;
    file_data;
    content:"javax.naming.InitialContext"; fast_pattern;
    content:"progress-class"; nocase;
    pcre:"/^\s*?=\s*?[\x22\x27]javax.naming.InitialContext/Rsi";
    content:"</jnlp>"; nocase; distance:0;
    reference:url,blog.trendmicro.com/trendlabs-security-intelligence/new-headaches-how-the-pawn-storm-zero-day-evaded-javas-click-to-play-protection/;
    classtype:targeted-activity;
    sid:2021985; rev:4;
    metadata:created_at 2015_10_21, confidence Medium, signature_severity Major, updated_at 2019_10_08;
)