alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"MODIFIED ET POLICY Windows Update in Progress 01"; flow:established,to_server; content:"Windows-Update-Agent"; http_header; content:"Host|3a|"; http_header; nocase; within:20; pcre:"/User-Agent\x3a[^\n]+Windows-Update-Agent/i"; flowbits:set,winupdate; flowbits:noalert; classtype:policy-violation; sid:3000000; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"MODIFIED ET POLICY PE EXE or DLL Windows file download"; flow:established,to_client; content:"MZ"; byte_jump:4,58,relative,little; content:"PE|00 00|"; distance:-64; within:4; flowbits:isnotset, winupdate; reference:url,doc.emergingthreats.net/bin/view/Main/2000419; classtype:policy-violation; sid:3000001; rev:1;)

alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"STP MODIFIED ET POLICY Windows Update in Progress 02"; flow:established,to_server; content:"windowsupdate.com"; http_header; content:"windowsupdate.com"; http_uri; flowbits:set,winupdate; flowbits:noalert; classtype:policy-violation; sid:3000002; rev:1;)