alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED SofosFO exploit kit jar download"; flow:established,to_server; content:"GET"; http_method; content:"files.php?"; http_uri; content:"&u="; http_uri; content:"&s="; http_uri; content:"&id="; http_uri; content:"&file="; http_uri; content:".jar"; http_uri; flowbits:set,et.exploitkitlanding; classtype:exploit-kit; sid:2015006; rev:7; metadata:created_at 2012_07_03, signature_severity Unknown, updated_at 2021_06_23;)