alert http $EXTERNAL_NET 81:90 -> $HOME_NET any (msg:"ET EXPLOIT_KIT Sakura - Payload Downloaded"; flow:established,to_client; flowbits:isset,ET.http.javaclient; http.header; content:".txt|0d 0a|"; fast_pattern; pcre:"/filename=[a-z]{4}\.txt\x0D\x0A/"; classtype:exploit-kit; sid:2016787; rev:5; metadata:created_at 2013_04_26, signature_severity Major, updated_at 2024_03_03;)