alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED CoolEK - PDF Exploit - Feb 12 2013"; flow:established,to_server; http.uri; content:".pdf"; nocase; fast_pattern; pcre:"/\/w(?:hite|orld|step)\/.*(?:(?:([A-Z][a-z]{3,20}[-._])?[A-Z][a-z]{3,20}|([a-z]{4,20}[-._])?[a-z]{4,20})\.pdf|([A-Z]{4,20}[-._])?[A-Z]{4,20}\.PDF)$/"; classtype:exploit-kit; sid:2016405; rev:10; metadata:created_at 2013_02_13, signature_severity Unknown, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2021_06_23;)