alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS SWF served from /tmp/"; flow:established,to_server; http.uri; content:"/tmp/"; fast_pattern; content:".swf"; endswith; pcre:"/\/tmp\/[^\/]+\.swf$/"; classtype:bad-unknown; sid:2011970; rev:2; metadata:created_at 2010_11_24, signature_severity Unknown, updated_at 2024_03_11;)