alert http1 $HOME_NET any -> $EXTERNAL_NET !80 (msg:"ET EXPLOIT_KIT Probable Nuclear exploit kit landing page"; flow:established,to_server; urilen:38; http.method; content:"GET"; http.uri; pcre:"/^\/[0-9a-f]{32}\.html$/U"; content:".html"; fast_pattern; endswith; http.header_names; content:"|0d 0a|Referer|0d 0a|"; classtype:exploit-kit; sid:2016952; rev:10; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2013_05_31, deployment Perimeter, malware_family Nuclear, signature_severity Critical, tag Exploit_Kit, tag Nuclear, updated_at 2024_04_07;)