ET MALWARE [PTsecurity] Possible Malicious (HTA-VBS-PowerShell) obfuscated command

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"ET MALWARE [PTsecurity] Possible Malicious (HTA-VBS-PowerShell) obfuscated command";
    flow:established,to_client;
    http.stat_code;
    content:"200";
    file.data;
    content:"<?xml"; depth:5;
    content:"|22|JScript|22|><![CDATA[ eval("; within:500; fast_pattern;
    pcre:"/%comSpec%\s\/c\s(?:(?:\\x50)|(?:\\x70)|[Pp])\^?(?:(?:\\x4f)|(?:\\x5f)|[Oo])\^?(?:(?:\\x57)|(?:\\x77)|[Ww])\^?(?:(?:\\x45)|(?:\\x65)|[Ee])\^?(?:(?:\\x52)|(?:\\x72)|[Rr])\^?(?:(?:\\x53)|(?:\\x73)|[Ss])\^?(?:(?:\\x48)|(?:\\x68)|[Hh])\^?(?:(?:\\x45)|(?:\\x65)|[Ee])\^?(?:(?:\\x4c)|(?:\\x6c)|[Ll])\^?(?:(?:\\x4c)|(?:\\x6c)|[Ll])\^?(?:(?:\\x2e)|\.)\^?(?:(?:\\x45)|(?:\\x65)|[Ee])\^?(?:(?:\\x58)|(?:\\x78)|[Xx])\^?(?:(?:\\x45)|(?:\\x65)|[Ee])\^?\s/R";
    classtype:trojan-activity;
    sid:2025558; rev:4;
    metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2018_05_03, deployment Perimeter, confidence High, signature_severity Major, updated_at 2020_11_16, mitre_tactic_id TA0005, mitre_tactic_name Defense_Evasion, mitre_technique_id T1027, mitre_technique_name Obfuscated_Files_or_Information;
)