alert http $HOME_NET any -> $EXTERNAL_NET !80 (msg:"ET EXPLOIT_KIT Archie EK T2 Landing Struct Nov 20 2014"; flow:established,to_server; urilen:70; http.uri; content:".html"; fast_pattern; offset:65; depth:5; endswith; pcre:"/^\/[a-f0-9]{64}\.html$/"; http.host; pcre:"/^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/"; classtype:exploit-kit; sid:2019769; rev:5; metadata:created_at 2014_11_21, confidence High, signature_severity Major, updated_at 2024_03_18;)