web-client.rules:alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"WEB-CLIENT Firefox javascript view-source\: and resource\: contains /// attempt"; flow:to_client,established; content:"view-source\:"; nocase; content:"resource\:"; nocase; within:15; distance:0; content:"///"; nocase; within:10; distance:0; classtype:web-application-activity; sid:92590; rev:1;)