alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Sweet Orange Landing Nov 04 2013"; flow:from_server,established; file_data; content:"|20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3e|"; fast_pattern:only; content:"|20|id=|22|"; pcre:"/^(?=[a-z]{0,7}[A-Z])(?=[A-Z]{0,7}[a-z])[A-Za-z]{8}\x22[^>]+?>[A-Za-z]{70}/Rs"; classtype:exploit-kit; sid:2019647; rev:5; metadata:created_at 2014_11_05, confidence High, signature_severity Major, updated_at 2019_07_26;)