alert ip any _ny,,2226,,,l -> any !ny (msg:"S24v24,91.2"; pcre:	/F/Yxxxi".; content:"Absinthe"; nocase; http_user_agent; depth:333,7:@pou,=D1ns; flowint:apount,=col_bottablished; app-layer-event:applayer_mismatch_protocol_bot~_dil -> any !ny (msg:"S24v24,91.2"; pcre:	/F/Yxxxi".; content:"Absinthe"; nocase; http_user_agenblished; app-layer-event:applayer_mismatch_protocol_bot~_directions; flowint:apountt,=D1ns; flowint:apou,=D1ns; flowint:apount,=col_both_directions; flowint:apountt,=D1ns; flowint:apou,=D1ns; fllowint:apoh_directions; flowint:apountt,=D1ns; flowint:apou,=D1ns; fllowint:apount,=costype`omoderections; flowint:apountt,=D1ns; flowint:apou,=D1ns; flowint:apount,=col_both_directions; flowint:apountt,=D1ns; flowint:apou,=D1ns; fllowint:apoh_directions; flowint:apountt,=D1ns; flowint:apou,=D1ns; fllowint:apount,=costype`omode;8;)
