alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT Magnitude CVE-2015-3113 Jun 29 2015 M1"; flow:established,to_server; urilen:10; http.uri; content:"/video.flv"; nocase; fast_pattern; http.referer; pcre:"/http\x3a\x2f+?(?:[\x2eg-z]*[a-f0-9][\x2eg-z]*){32}\.[^\x2f\r\n]*?\x2f+\[\[DYNAMIC\]\]\x2f\d*?$/"; http.host; pcre:"/^(?:[\x2eg-z]*[a-f0-9][\x2eg-z]*){32}\./"; classtype:exploit-kit; sid:2021364; rev:4; metadata:created_at 2015_06_29, signature_severity Major, tag CISA_KEV, updated_at 2024_03_17;)