alert http $EXTERNAL_NET any -> $HOME_NET any (
msg:"ET WEB_CLIENT Possible CookieBomb Generic JavaScript Format";
flow:from_server,established;
file_data;
content:"/*/"; fast_pattern;
pcre:"/^[a-f0-9]{6}\*\//R";
content:"=";
pcre:"/^[\r\n\s]*?\x5c?[\x22\x27]/R";
content:!"|22|"; within:500;
content:!"|27|"; within:500;
pcre:"/^([a-f0-9]{2}[^\x22\x27a-f0-9]{0,10})?(?P<f>[a-f0-9]{2})(?P<sep>[^\x22\x27a-f0-9]{0,10})(?P<u>(?!(?P=f))[a-f0-9]{2})(?P=sep)(?P<n>(?!(?:(?P=f)|(?P=u)))[a-f0-9]{2})(?P=sep)(?P<c>(?!(?:(?P=f)|(?P=u)|(?P=n)))[a-f0-9]{2})(?P=sep)(?P<t>(?!(?:(?P=f)|(?P=u)|(?P=n)|(?P=c)))[a-f0-9]{2})(?P=sep)(?P<i>(?!(?:(?P=f)|(?P=u)|(?P=n)|(?P=c)|(?P=t)))[a-f0-9]{2})(?P=sep)(?P<o>(?!(?:(?P=f)|(?P=u)|(?P=n)|(?P=c)|(?P=t)|(?P=i)))[a-f0-9]{2})(?P=sep)(?P=n)(?P=sep)(?P<spc>[a-f0-9]{2})(?P=sep)([a-f0-9]{2}(?P=sep)){1,100}(?P=spc)/Ri";
classtype:trojan-activity;
sid:2017373; rev:6;
metadata:created_at 2013_08_26, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2019_07_26;
)