alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible EITest Flash Redirect"; flow:established,to_client; file.data; content:"|20|name=|22|EITest|22 20|"; fast_pattern; reference:url,blog.malwarebytes.org/exploits-2/2014/10/exposing-the-flash-eitest-malware-campaign/; classtype:trojan-activity; sid:2019610; rev:3; metadata:created_at 2014_10_31, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_14;)