alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED CoolEK Payload Download (7)"; flow:established,to_server; http.uri; content:"/get"; fast_pattern; content:".jpg"; pcre:"/\/(?:w(?:hite|orld)|step)\/get(?:a+|n+)\.jpg/"; classtype:exploit-kit; sid:2016559; rev:18; metadata:created_at 2013_03_09, signature_severity Unknown, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2021_06_23;)