ET INFO Windows Update/Microsoft FP Flowbit M4

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"ET INFO Windows Update/Microsoft FP Flowbit M4";
    flow:established,to_server;
    flowbits:set,ET.INFO.WindowsUpdate;
    flowbits:noalert;
    http.method;
    content:"GET";
    http.uri;
    content:"cacheHostOrigin="; fast_pattern;
    pcre:"/(?:^|\x2e)(?:windowsupdate\x2ecom|update\x2emicrosoft\x2ecom|delivery\x2emp\x2emicrosoft\x2ecom)$/R";
    reference:url,techcommunity.microsoft.com/blog/windows-itpro-blog/microsoft-connected-cache-for-isps-microsoft%E2%80%99s-distributed-cdn/3891604;
    classtype:not-suspicious;
    sid:2059288; rev:1;
    metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, tls_state plaintext, created_at 2025_01_16, deployment Perimeter, performance_impact Low, confidence High, signature_severity Informational, tag windowsupdate, updated_at 2025_01_16;
)