alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Possible PurpleFox? EK Framework Landing"; flow:established,to_client; file_data; content:"|0d 0a||0d 0a||0d 0a||0d 0a|