alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT Fiesta URI Struct"; flow:established,to_server; flowbits:set,ET.Fiesta.Exploit.URI; urilen:>64; http.uri; content:"|3b|"; offset:63; fast_pattern; content:!"="; content:!"&"; pcre:"/^\/[^\x2f]+?\/\??[a-f0-9]{60,66}(?:\x3b\d+){1,4}$/"; classtype:exploit-kit; sid:2018407; rev:11; metadata:created_at 2014_04_23, signature_severity Major, updated_at 2024_03_14;)