alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET WEB_CLIENT Upatre redirector 29 Sept 2014 - POST"; flow:established,to_server; flowbits:set,et.exploitkitlanding; http.method; content:"POST"; http.request_body; content:"h="; depth:3; content:"w="; within:8; content:"ua="; fast_pattern; within:8; classtype:trojan-activity; sid:2019321; rev:4; metadata:created_at 2014_09_30, signature_severity Major, updated_at 2024_03_13;)