alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Successful Airbnb COVID-19 Phish 2020-03-26"; flow:established,to_client; flowbits:isset,ET.genericphish; content:"200"; http_stat_code; file_data; content:"