alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED TDS Sutra Exploit Kit Redirect Received"; flow:established,from_server; content:"302"; http_stat_code; content:"=_"; http_header; content:"_|3b| domain="; http_header; distance:1; within:10; pcre:"/^[a-z]{5}\d=\x5f\d\x5f/C"; classtype:exploit-kit; sid:2014220; rev:8; metadata:created_at 2012_02_11, signature_severity Unknown, tag TDS, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2021_06_23;)