ET WEB_CLIENT CookieBomb Generic HTML Format

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"ET WEB_CLIENT CookieBomb Generic HTML Format";
    flow:from_server,established;
    file_data;
    content:"<!--/"; fast_pattern;
    pcre:"/^[a-f0-9]{6}\-\-\>/R";
    content:"=";
    pcre:"/^[\r\n\s]*?\x5c?[\x22\x27]/R";
    content:!"|22|"; within:500;
    content:!"|27|"; within:500;
    pcre:"/^([a-f0-9]{2}[^\x22\x27a-f0-9]{0,10})?(?P<f>[a-f0-9]{2})(?P<sep>[^\x22\x27a-f0-9]{0,10})(?P<u>(?!(?P=f))[a-f0-9]{2})(?P=sep)(?P<n>(?!(?:(?P=f)|(?P=u)))[a-f0-9]{2})(?P=sep)(?P<c>(?!(?:(?P=f)|(?P=u)|(?P=n)))[a-f0-9]{2})(?P=sep)(?P<t>(?!(?:(?P=f)|(?P=u)|(?P=n)|(?P=c)))[a-f0-9]{2})(?P=sep)(?P<i>(?!(?:(?P=f)|(?P=u)|(?P=n)|(?P=c)|(?P=t)))[a-f0-9]{2})(?P=sep)(?P<o>(?!(?:(?P=f)|(?P=u)|(?P=n)|(?P=c)|(?P=t)|(?P=i)))[a-f0-9]{2})(?P=sep)(?P=n)(?P=sep)(?P<spc>[a-f0-9]{2})(?P=sep)([a-f0-9]{2}(?P=sep)){1,100}(?P=spc)/Ri";
    classtype:trojan-activity;
    sid:2017375; rev:6;
    metadata:created_at 2013_08_26, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2019_07_26;
)