False Positive: Nuclear Exploit Kit

False Positive
Reported by neonprimetime security
http://neonprimetime.blogspot.com
NOTES: From what I've seen the Nuclear exploit kit looks like "\/14\d{8}\.swf" but this matches "\.swf\/14\d{8}"
******

    alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"EXPLOIT-KIT Nuclear exploit kit outbound Adobe Flash exploit request"; flow:to_server,established; content:"/14"; fast_pattern:only; http_uri; content:".swf"; http_uri; pcre:"/\/14\d{8}(?:\.swf)?$/U"; flowbits:set,file.exploit_kit.flash; metadata:policy balanced-ips drop, policy security-ips drop, service http; classtype:trojan-activity; sid:32878; rev:1; )

*******

GET http://ads.img.globo.com/RealMedia/ads/Creatives/globocom/93598-1_5240_GE_Formula_1_Patrocinio_2014_Integrado__Retangulo_M/19538_300x250_Santander_Dezembro.swf/1419014410 HTTP/1.1