alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT Fragus Exploit Kit Landing"; flow:established,to_server; http.uri; content:".php?"; nocase; content:"id="; nocase; content:"pid="; nocase; content:"hello="; fast_pattern; nocase; pcre:"/\.php\?(?:id=|pid=|hello=)\d+&(?:id=|pid=|hello=)\d+&(?:id=|pid=|hello=)\d+$/i"; reference:url,jsunpack.jeek.org/dec/go?report=d60344851322218108076f1ad8d21435de9d5b7c; reference:url,www.malwareurl.com; classtype:exploit-kit; sid:2011693; rev:6; metadata:created_at 2010_07_30, signature_severity Major, updated_at 2024_03_16;)