[SOPHOS_FIREWALL] Web Content Filter - Malicious File Detected

alert any $HOME_NET any -> $HOME_NET any (msg:"[SOPHOS_FIREWALL] Web Content Filter - Malicious File Detected"; program:sophos; content:"log_type=
| 22
| Content Filtering
| 22
| "; content:"reason=
| 22
| cloud malicious
| 22
| "; parse_src_ip:1; parse_dst_ip:2; normalize; reference:url,https://docs.sophos.com/nsg/sophos-firewall/21.5/pdf/sf-syslog-guide-21.5.pdf; classtype:suspicious-activity; sid:5017874; metadata: createdOn 2026_04_03, updatedOn 2026_04_03; rev:1;)