alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO Lucy Security - Awareness Landing Page M2"; flow:established,to_client; http.cookie; content:"link="; content:", awareness_link="; http.response_body; content:"|0d 0a 3c|head|3e 3c|script|20|src|3d 22 2f|js|2f|events|2e|js|22 3e 3c 2f|script|3e|"; depth:300; fast_pattern; content:"href|3d 22 2f|public|2f|campaign|2f|"; content:"/awareness/"; within:25; content:!"submitLP|28 29|"; reference:url,lucysecurity.com; classtype:bad-unknown; sid:2049834; rev:1; metadata:attack_target Client_Endpoint, created_at 2023_12_26, deployment Perimeter, deployment SSLDecrypt, malware_family Lucy, malware_family Lucy_Awareness, performance_impact Low, confidence High, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2023_12_26;)