alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT Nuclear EK IE Exploit Aug 23 2015"; flow:established,to_server; urilen:>50; http.method; content:"POST"; http.uri; pcre:"/\?(?=[a-z\d\x3d&\x2e]*?[A-Z])(?=[A-Z\d=&\x2e]*?[a-z])(?=[A-Za-z=&\x2e]*?\d)[A-Za-z\d=&\x2e]{50,}$/"; http.content_type; content:"application/json"; http.request_body; content:"|22 67 22 3a 22|"; fast_pattern; content:"|22 70 22 3a 22|"; content:"|22 41 22 3a 22|"; classtype:exploit-kit; sid:2021708; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2015_08_24, deployment Perimeter, malware_family Nuclear, confidence High, signature_severity Critical, tag Exploit_Kit, tag Nuclear, updated_at 2024_02_23;)