ET EXPLOIT Metasploit 2013-3346

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"ET EXPLOIT Metasploit 2013-3346";
    flow:established,from_server;
    file_data;
    content:"5 0 R>>|0a|endobj|0a|5 0 obj |0a|<</";
    pcre:"/^(?:L|#4c)(?:e|#65)(?:n|#6e)(?:g|#67)(?:t|#74)(?:h|#68)\x20\d+?\/(?:F|#46)(?:i|#69)(?:l|#6c)(?:t|#74)(?:e|#65)(?:r|#72)\[\/(?:F|#46)(?:l|#6c)(?:a|#61)(?:t|#74)(?:e|#65)(?:D|#44)(?:e|#65)(?:c|#63)(?:o|#6f)(?:d|#64)(?:e|#65)\/(?:A|#41)(?:S|#53)(?:C|#43)(?:I|#49){2}(?:H|#48)(?:e|#65)(?:x|#78)(?:D|#44)(?:e|#65)(?:c|#63)(?:o|#6f)(?:d|#64)(?:e|#65)\]>>/Rs";
    content:"5 0 R>>|0a|endobj|0a|5 0 obj |0a|<<";
    pcre:"/^(?:(?!>>).)+?#(?:[46][1-9a-fA-F]|[57][\daA])/Rs";
    classtype:attempted-admin;
    sid:2017900; rev:3;
    metadata:affected_product Any, attack_target Client_and_Server, created_at 2013_12_24, deployment Perimeter, deployment Internet, deployment Internal, deployment Datacenter, signature_severity Critical, tag Metasploit, updated_at 2019_07_26;
)