alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Outlook WebApp Phish Landing 2015-11-05"; flow:established,from_server; file_data; content:"var translate_dict = {"; nocase; content:"VERIFICATION_CODE"; nocase; distance:0; fast_pattern; content:"VERIFICATION_CODE_REQUIRED"; nocase; distance:0; content:"NOT_BEGIN_OR_END_WITH_SPACE"; nocase; distance:0; content:"USERNAME_ALL_NUMERIC"; nocase; distance:0; content:"PASSWORDS_DONT_MATCH"; nocase; distance:0; content:"PWD_HINT_REQUIRED"; nocase; distance:0; content:"PASSWORD_MATCHES_USERNAME"; nocase; distance:0; content:"REQUEST_PASSWORD_RESET"; nocase; distance:0; content:"ENTER_VALID_VERIFICATION_CODE"; nocase; distance:0; content:"PASSWORD_MATCH_HINT"; nocase; distance:0; content:"Your work here is done"; nocase; distance:0; content:"Yikes! Something's gone wrong."; nocase; distance:0; classtype:social-engineering; sid:2031691; rev:2; metadata:created_at 2015_11_05, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2019_07_26;)