alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET HUNTING Base64 Encoded ISO File in HTML Body (Magic Bytes)"; flow:established,to_client; flowbits:set,et.exploitkitlanding; file_data; content:"Q0QwMD"; fast_pattern; content:"DRDAwM"; distance:2725; within:100; content:"NEMDAx"; distance:2725; within:100; reference:url,urlscan.io/result/98d7e72b-67b8-4d7c-9735-c27525b0a550/#transactions; classtype:misc-activity; sid:2047788; rev:2; metadata:attack_target Client_Endpoint, created_at 2023_08_28, deployment Perimeter, deployment SSLDecrypt, performance_impact Low, confidence High, signature_severity Informational, tag HTML_Smuggling, updated_at 2023_10_10, reviewed_at 2023_10_10; target:dest_ip;)