alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT StyX Landing Page"; flow:established,to_server; urilen:>100; flowbits:set,et.exploitkitlanding; http.uri; content:"/i.html?0x"; startswith; pcre:"/^\d{1,2}=[a-zA-Z0-9+=]{100}/R"; classtype:exploit-kit; sid:2016248; rev:7; metadata:created_at 2013_01_22, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_04_23;)