alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT DRIVEBY Unknown EK Landing"; flow:established,to_client; file.data; content:"|64 6f 63 75 6d 65 6e 74 2e 6c 6f 63 61 74 69 6f 6e 2e 68 6f 73 74 6e 61 6d 65 2e 6c 65 6e 67 74 68 3e 30 29 7b|"; fast_pattern; content:"|3d 22 31 22 2b 22 31 22 3b 64 65 6c 65 74 65|"; distance:0; content:"|2b 3d 22 30 22 2b 22 30 22 2b 22 30 22 2b 22 30 22 2b 22 30 22 2b 22 30 22 2b 22 30 22 2b 22 30 22 2b 22 30 22 2b 22 30 22 2b 22 30 22|"; distance:0; classtype:exploit-kit; sid:2020501; rev:5; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2015_02_23, deployment Perimeter, confidence Medium, signature_severity Major, tag DriveBy, updated_at 2024_04_07;)