alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Suspicious Decimal IP Redirect - Observed in RIG EK Redirects M4"; flow:established,to_client; http.stat_code; content:"302"; http.location; content:"http|3a 2f 2f|3"; startswith; fast_pattern; nocase; pcre:"/^\d+(?:\x2f|$)/R"; http.content_len; byte_test:0,=,0,0,string,dec; http.content_type; content:"text/html"; startswith; reference:url,blog.malwarebytes.com/cybercrime/2017/03/websites-compromised-decimal-ip-campaign/; classtype:exploit-kit; sid:2024136; rev:6; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2017_03_31, deployment Perimeter, malware_family RIG, confidence Medium, signature_severity Major, tag Redirector, updated_at 2024_05_04;)