alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET WEB_CLIENT Sweet Orange WxH redirection"; flow:established,to_server; urilen:23<>50; http.uri; content:"x"; depth:4; offset:2; content:".php?"; fast_pattern; content:"="; within:3; pcre:"/^\/[0-9]{2,3}x[0-9]{2,3}\/[a-z]+\.php\?[a-z]{2}=[0-9a-z]+$/"; classtype:exploit-kit; sid:2018493; rev:5; metadata:created_at 2014_05_21, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_18;)