ET EXPLOIT_KIT Evil Redirector Leading to EK Mon Dec 21 2015 5

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"ET EXPLOIT_KIT Evil Redirector Leading to EK Mon Dec 21 2015 5";
    flow:from_server,established;
    file_data;
    content:"|3f 22 5c 78|"; fast_pattern;
    byte_test:1,>,0x2f,-5,relative;
    byte_test:1,<,0x3a,-5,relative;
    content:"var ";
    pcre:"/^\s*?[a-z]+\s*?=\s*?\x28\d+[<>]\d+\?\s*?\x22[^\x22]+\x22\s*?\x3a\s*?\x22[^\x22]+\x22\s*?\x29\s*?[\x3b\x2b].*?(?<=[\x3d\x2b])\x28\d+[<>]\d+\?\s*?\x22[^\x22]+\x22\s*?\x3a\s*?\x22[^\x22]+\x22\s*?\x29\s*?[\x3b\x2b].*?(?<=[\x3d\x2b])\x28\d+[<>]\d+\?\s*?\x22[^\x22]+\x22\s*?\x3a\s*?\x22[^\x22]+\x22\s*?\x29\s*?[\x3b\x2b].*?(?<=[\x3d\x2b])\x28\d+[<>]\d+\?\s*?\x22[^\x22]+\x22\s*?\x3a\s*?\x22[^\x22]+\x22\s*?\x29\s*?[\x3b\x2b]/Rsi";
    reference:url,blog.sucuri.net/2015/12/evolution-of-pseudo-darkleech.html;
    classtype:exploit-kit;
    sid:2022290; rev:3;
    metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2015_12_21, deployment Perimeter, confidence High, signature_severity Major, tag Redirector, updated_at 2019_07_26;
)