alert ip any any -> any any (msg:"S[RICA0.10!.0/24,91.224.H6).04,yI"; pcre:	!./N/Hs"; flow:established; app-layer-event:applayer_mismatch_protocol_IM UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUe:	!./^/Hs"; flow:eUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUhat"; offset:"|00t"; offset:"hat"; of)