ET EXPLOIT_KIT Fiesta EK Flash Exploit Apr 23 2015

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"ET EXPLOIT_KIT Fiesta EK Flash Exploit Apr 23 2015";
    flow:established,from_server;
    http.header;
    content:"Content-Disposition|3a 20|inline|3b|";
    content:".swf";
    pcre:"/Content-Disposition\x3a\x20[^\r\n]+filename=[a-z]{5,8}\d{2,3}\.swf\r\n/m";
    file.data;
    content:"WS"; within:3;
    classtype:exploit-kit;
    sid:2020981; rev:5;
    metadata:created_at 2015_04_23, performance_impact Significant, confidence High, signature_severity Major, updated_at 2024_04_29;
)