alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"EICAR test virus"; \
 content:"X5O!P%@AP[4|5c|PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*"; \
  classtype:not-suspicious; \
   reference:url,www.eicar.org/anti_virus_test_file.htm; rev:1;)