alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Generic Phishkit Landing Page M2"; flow:established,to_client; file.data; content:"|2e|php"; content:"onSubmit|3d 22|return|20|validateMyForm|28 29 3b 22|"; distance:0; content:"id|3d 27 5f|form|5f|"; distance:0; content:"enctype|3d 27|multipart|2f|form|2d|data|27|"; fast_pattern; distance:0; reference:md5,3112bc432450ae3d08a0491ccaaf914d; classtype:credential-theft; sid:2034190; rev:2; metadata:attack_target Client_Endpoint, created_at 2021_10_12, deployment Perimeter, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2021_10_13;)