alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER ImageMagick CVE-2016-3714 Inbound (svg)"; flow:established,to_server; http.request_body; content:"<svg|20|"; nocase; fast_pattern; content:"xlink"; nocase; pcre:"/xlink\s*?\x3a\s*?href\s*?=\s*?(:[\x22\x27]|\\x2[27])https.+?&quot\s*?\x3b(?:\x7c|&(?:[gl]t|amp)\s*?\x3b)/si"; classtype:web-application-attack; sid:2022790; rev:6; metadata:created_at 2016_05_04, cve CVE_2016_3714, signature_severity Major, tag CISA_KEV, updated_at 2020_10_06;)