alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Malicious Iframe Leading to EK"; flow:established,to_client; file.data; content:"document.write((|22|<iframe src=|27|http|3a|"; within:35; pcre:"/^[^\x27]+[\x27]\s*/R"; content:"width=12 height=12 frameborder=0 marginheight=0 marginwidth=0 scrolling=no></|22| + |22|iframe>|22|))|3b|"; fast_pattern; within:93; isdataat:!3,relative; classtype:exploit-kit; sid:2019798; rev:5; metadata:created_at 2014_11_25, confidence High, signature_severity Major, updated_at 2024_03_14;)