alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE ehow/livestrong Malicious Flash 10/11"; flow:established,to_server; urilen:13; http.uri; content:".swf"; fast_pattern; offset:9; depth:4; endswith; pcre:"/^\/[a-f0-9]{8}\.swf$/"; http.referer; pcre:"/^[^\r\n]+\/[a-f0-9]{8}\/1(?:0\/[0-2]|1\/\d)\/$/"; classtype:trojan-activity; sid:2018029; rev:3; metadata:created_at 2014_01_28, signature_severity Major, updated_at 2024_03_18;)