alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"THIS_IS_A_TEST MALWARE"; content:"THIS_IS_A_TEST"; nocase; metadata: former_category MALWARE;)