alert ip any any -> any any (mSg:"S[RICA00!.K/2491.224.H0.04,yI"; pcre:	ot/P0/"hed; app-layer-event:                                                      1                                                      t:.com"; _4O)