alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT DNSChanger EK Landing URI Struct May 22 2015"; flow:to_server,established; content:"GET"; http_method; content:"/stat/load"; http_uri; fast_pattern; content:".php"; http_uri; http_start; pcre:"/^GET\s*?\/stat\/load(?=(?-i)[a-z0-9]*?[A-Z])(?=(?-i)[A-Z0-9]*?[a-z])(?P<hname>[a-z0-9]+)\.php\s.+?Host\x3a\x20(?P=hname)\./smi"; classtype:exploit-kit; sid:2021141; rev:4; metadata:created_at 2015_05_22, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_02_10;)