alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT GENERIC VB ShellExecute? Function Inside of VBSCRIPT tag"; flow:to_client,established; file_data; content:"vbscript"; nocase; content:"shellexecute"; nocase; fast_pattern; content:"