alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED MALVERTISING SL_*_0000 JavaScript redirect"; flow:established,to_client; content:"200"; http_stat_code; content:"SL_"; http_cookie; content:"_0000="; http_cookie; content:"window.location"; classtype:bad-unknown; sid:2013012; rev:4; metadata:created_at 2011_06_10, signature_severity Unknown, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2019_07_26;)