alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET WEB_CLIENT DRIVEBY Redirection - Forum Injection"; flow:established,to_server; urilen:27<>33; http.uri; content:".js?"; fast_pattern; pcre:"/^\/[a-z]{7,11}\.js\?[a-f0-9]{16}$/"; classtype:trojan-activity; sid:2017453; rev:6; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2013_09_11, deployment Perimeter, signature_severity Major, tag DriveBy, updated_at 2020_09_21;)