alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT Fiesta URI Struct"; flow:established,to_server; urilen:>64; flowbits:set,ET.Fiesta.Exploit.URI; http.uri; content:"|3b|"; offset:63; fast_pattern; content:!"="; content:!"&"; pcre:"/^\/[^\x2f]+?\/\??[a-f0-9]{60,66}(?:\x3b\d+){1,4}$/"; classtype:exploit-kit; sid:2018407; rev:10; metadata:created_at 2014_04_23, signature_severity Major, updated_at 2020_05_13;)