alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED RedKit /h***.htm(l) Landing Page - Set"; flow:established,to_server; urilen:8<>11; content:"/h"; depth:2; http_uri; pcre:"/^\/h[a-z]{3}\.html?$/U"; flowbits:set,ET.http.driveby.redkit.uri; flowbits:noalert; classtype:exploit-kit; sid:2015927; rev:4; metadata:created_at 2012_11_27, signature_severity Unknown, updated_at 2019_07_26;)