alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Obfuscated LordEK? Landing M1"; flow:established,from_server; content:"200"; http_stat_code; file_data; content:"|0d 0a||0d 0a|<|2f|head>|0d 0a||0d 0a 20 20 20 20|