alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"WEB-CLIENT Safari file:// and % attempt"; flow:to_client,established; content:"file\://"; nocase; content:"%"; within:3; distance:0; pcre:!"/[a-z0-9]file\:\/\/(.){0,2}\%/i"; classtype:web-application-attack; sid:92806; rev:1;)