alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO 3XX redirect to data URL"; flow:established,to_client; http.stat_code; content:"3"; depth:1; http.location; content:"data|3a|"; fast_pattern; depth:5; classtype:misc-activity; sid:2015674; rev:7; metadata:attack_target Client_Endpoint, created_at 2012_09_05, deployment Perimeter, confidence High, signature_severity Minor, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_01_22, reviewed_at 2024_03_25; target:dest_ip;)