ET MALWARE Steganographic Encoded WAV File Inbound via HTTP M1

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"ET MALWARE Steganographic Encoded WAV File Inbound via HTTP M1";
    flow:established,from_server;
    http.stat_code;
    content:"200";
    file.data;
    content:"RIFF"; startswith;
    content:"WAVE"; distance:4; within:4;
    content:"|0B 87 06 53 DF 3A|"; distance:32; within:6; fast_pattern;
    reference:url,threatvector.cylance.com/en_us/home/malicious-payloads-hiding-beneath-the-wav.html;
    classtype:trojan-activity;
    sid:2028876; rev:2;
    metadata:created_at 2019_10_18, deployment Perimeter, performance_impact Low, confidence Medium, signature_severity Major, updated_at 2020_10_20;
)