alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Propack Recent Jar (1)"; flow:established,from_server; file_data; content:"PK"; within:2; content:"propack/"; distance:0; classtype:exploit-kit; sid:2015949; rev:2; metadata:created_at 2012_11_28, signature_severity Major, updated_at 2019_07_26;)