alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER safe_mode PHP config option in uri"; flow:established,to_server; http.uri; content:"safe_mode"; fast_pattern; pcre:"/\bsafe_mode\s*?=/"; reference:url,seclists.org/fulldisclosure/2013/Jun/21; classtype:trojan-activity; sid:2016978; rev:5; metadata:created_at 2013_06_06, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_09_18;)