alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Possible GoonEK Landing Feb 19 2014 1"; flow:established,to_client; file.data; content:"javafx_version"; nocase; fast_pattern; content:"jnlp_href"; nocase; content:"</applet><object"; nocase; content:"data|3a|application/x-silverlight-2"; nocase; within:100; classtype:exploit-kit; sid:2018161; rev:3; metadata:created_at 2014_02_20, confidence Medium, signature_severity Major, updated_at 2024_03_13;)