alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT g01pack Exploit Kit Landing Page (2)"; flow:established,to_server; urilen:>2; http.uri; content:"/"; endswith; pcre:"/^\/[a-z]+\/$/"; http.host; content:".mine.nu"; fast_pattern; endswith; classtype:exploit-kit; sid:2015758; rev:4; metadata:created_at 2012_10_04, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_01;)