alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Darksword iOS EK Landing Page"; flow:established,to_client; http.response_body; content:"document.write|28 27 3c|script defer|3d 5c 22|defer|5c 22|"; content:"|2e|js|3f 27 2b|Date|2e|now|28 29 2b 27 5c 22 5c 3e 5c 3c 5c 2f|script|5c 3e 27 29 3b 3c 2f|script|3e|"; fast_pattern; distance:0; pcre:"/document\x2ewrite\x28[^\x29]*?\w+\x2ejs\x3f\x27\x2bDate\x2enow\x28\x29/"; classtype:exploit-kit; sid:2071989; rev:1; metadata:attack_target Client_Endpoint, tls_state TLSDecrypt, created_at 2026_09_10, deployment Perimeter, confidence High, signature_severity Major, tag Exploit, updated_at 2026_09_10, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1189, mitre_technique_name Drive_by_Compromise; target:dest_ip;)