alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT JDB Exploit Kit JAR Download"; flow:established,to_server; http.uri; content:".php?id="; nocase; pcre:"/\.php\?id=[a-f0-9]{32}$/i"; http.user_agent; content:"Java/1."; fast_pattern; classtype:exploit-kit; sid:2016309; rev:9; metadata:created_at 2013_01_30, signature_severity Major, updated_at 2020_09_18;)