alert http $EXTERNAL_NET any -> $HOME_NET any (
msg:"ET WEB_CLIENT Download of PDF With Compressed Flash Content";
flowbits:noalert;
flow:established,to_client;
content:"stream";
content:"|0A|CWS"; within:5; fast_pattern;
pcre:"/stream(\x0D\x0A|\x0A)CWS/";
flowbits:set,ET.flash.pdf;
reference:url,www.symantec.com/connect/blogs/analysis-zero-day-exploit-adobe-flash-and-reader;
reference:url,blog.zynamics.com/2010/06/09/analyzing-the-currently-exploited-0-day-for-adobe-reader-and-adobe-flash/;
classtype:misc-activity;
sid:2012907; rev:3;
metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2011_05_31, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2019_07_26;
)