alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN Redirect on ActiveXObject? support"; flow:established,to_client; content:"200"; http_stat_code; file_data; content:"