##alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED pamdql applet with obfuscated URL"; flow:established,from_server; file_data; content:"applet"; fast_pattern; content:"103hj115hj115hj111hj57hj46hj46hj"; within:200; flowbits:set,et.exploitkitlanding; classtype:bad-unknown; sid:2015739; rev:6;)

Added 2013-06-07 22:02:37 UTC

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS pamdql applet with obfuscated URL"; flow:established,from_server; file_data; content:"applet"; fast_pattern; content:"103hj115hj115hj111hj57hj46hj46hj"; within:200; flowbits:set,et.exploitkitlanding; classtype:bad-unknown; sid:2015739; rev:4;)

Added 2012-11-26 22:42:40 UTC

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS pamdql applet with obfuscated URL"; flow:established,from_server; file_data; content:"applet"; fast_pattern; content:"103--115--115--111--57--46--46--"; within:200; flowbits:set,et.exploitkitlanding; classtype:bad-unknown; sid:2015739; rev:3;)

Added 2012-11-15 19:06:24 UTC

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS pamdql applet with obfuscated URL"; flow:established,from_server; content:"applet"; fast_pattern; content:"103!115!115!111!57!46!46!"; within:200; flowbits:set,et.exploitkitlanding; classtype:bad-unknown; sid:2015739; rev:1;)

Added 2012-09-25 23:25:45 UTC

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS pamdql applet with obfuscated URL"; flow:established,from_server; content:"applet"; fast_pattern; content:"103!115!115!111!57!46!46!"; within:200; flowbits:set,et.exploitkitlanding; classtype:bad-unknown; sid:2015739; rev:1;)

Added 2012-09-25 23:22:04 UTC

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS pamdql applet with obfuscated URL"; flow:established,from_server; content:"applet"; fast_pattern; content:"103!115!115!111!57!46!46!"; within:200; flowbits:set,et.exploitkitlanding; classtype:bad-unknown; sid:2015739; rev:1;)

Added 2012-09-25 23:04:55 UTC

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS pamdql applet with obfuscated URL"; flow:established,from_server; content:"applet"; fast_pattern; content:"103!115!115!111!57!46!46!"; within:200; flowbits:set,et.exploitkitlanding; classtype:bad-unknown; sid:2015739; rev:1;)

Added 2012-09-25 22:16:09 UTC