alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible DarkHotel Landing M1"; flow:to_client,established; file_data; content:"eval|28|"; pcre:"/^[a-z]\x29/Rsi"; content:"Problems in loading internet explorer"; distance:0; content:"Try again after update your systems."; distance:0; fast_pattern; reference:url,securelist.com/blog/research/71713/darkhotels-attacks-in-2015/; classtype:targeted-activity; sid:2021609; rev:3; metadata:created_at 2015_08_11, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2022_03_17;)