alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT Fiesta Flash Exploit URI Struct"; flow:established,to_server; urilen:>68; http.uri; content:"|3b|1"; offset:60; content:"|3b|"; distance:5; within:1; content:!"="; content:!"&"; pcre:"/\/\??[a-f0-9]{60,}\x3b1\d{5}\x3b\d{1,3}$/"; classtype:exploit-kit; sid:2019612; rev:8; metadata:created_at 2014_10_31, signature_severity Major, updated_at 2020_05_13;)