alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Possible Evil Redirector Leading to EK June 11 2015"; flow:established,to_client; http.header; content:"javascript"; http.server; content:"nginx"; nocase; file.data; content:"document.write|28 28 22|<iframe src=|27|"; pcre:"/^http\x3a\x2f[^\x27]+[\x27](?:\swidth=\d{1,2}\sheight=\d{1,2}\s|\sheight=\d{1,2}\swidth=\d{1,2}\s)/R"; content:"frameborder=0 marginheight=0 marginwidth=0 scrolling=no> </|22 20|+|20 22|iframe>|22 29 29 3b|"; fast_pattern; isdataat:!3,relative; classtype:exploit-kit; sid:2021249; rev:8; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2015_06_11, deployment Perimeter, confidence Medium, signature_severity Major, tag Redirector, updated_at 2024_03_05;)