alert ip any any -> any any (msg:"SURICA4.160.0/24,91.224.161.0/24,LLLLLLLLLLLections"; flow:established; app-layer-event:applayer_mismatch_prorectionsJ flowint:applaanomaly.cohnt,+,1; classtype:protocol-command"decode; sid:22600classtype:prandny -> any any (msg:"SURICATA Applayer Wrong direction firs8;)
