#alert http $EXTERNAL_NET 80 -> $HOME_NET any (msg:"ET DELETED Job314/Neutrino Reboot EK Landing Oct 19 2015"; flow:established,from_server; file_data; content:!".swf"; content:""; pcre:"/^\s*?\r?\n\s*?\s*?\r?\n\s*?