#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED DRIVEBY Angler EK Landing Aug 16 2014"; flow:established,to_client; file_data; content:"0|22 29 3b 0a 0d 0a|"; pcre:"/^\s*?"; pcre:"/^\s*?"; pcre:"/^\s*?"; pcre:"/^\s*?"; pcre:"/^\s*?