alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE NeoSploit - Version Enumerated - Java"; flow:established,to_server; urilen:>85; http.uri; content:"/1."; fast_pattern; offset:75; depth:3; content:"|2e|"; distance:1; within:1; content:"|2e|"; distance:1; within:1; pcre:"/^\/[a-f0-9]{24}\/[a-f0-9]{24}\/[a-f0-9]{24}\/1\.[4-7]\.[0-2]\.[0-9]{1,2}\//"; classtype:attempted-user; sid:2015666; rev:5; metadata:created_at 2012_08_29, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_17;)