ET MALWARE MalDoc Retrieving Payload 2021-06-15

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"ET MALWARE MalDoc Retrieving Payload 2021-06-15";
    flow:established,to_server;
    http.method;
    content:"GET";
    http.uri;
    content:".dat"; endswith;
    pcre:"/\.[0-9]{6,18}\.dat$/";
    http.host;
    pcre:"/^(?:[0-9]{1,3}\.){3}[0-9]{1,3}$/";
    http.user_agent;
    content:"Mozilla/4.0 (compatible|3b 20|MSIE 7.0|3b 20|Windows NT 6.1|3b 20|WOW64|3b 20|Trident/7.0|3b 20|SLCC2|3b 20|.NET CLR 2.0.50727|3b 20|.NET CLR 3.5.30729|3b 20|.NET CLR 3.0.30729|3b 20|Media Center PC 6.0|3b 20|.NET4.0C|3b 20|.NET4.0E)"; bsize:178; fast_pattern;
    http.header_names;
    content:!"Referer";
    classtype:trojan-activity;
    sid:2034460; rev:1;
    metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2021_06_15, deployment Perimeter, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2021_06_15;
)