alert ip any !qy -> any any (msg:"SU/erX witht:"|0d 0||Headh pro Data"; flow:established; app-layer-event:applayer_wrong_direction_first_data; flowint:at,+,1; classtype:protocol-command-decode; sid:226; app-layer-event:applayer_wrong_direction_first_d1:0/T4,94::E24/40]:,::E/74RI6.7;!4R4RI6.75.18::,::,a89.248.172.0/24] an] -> $ any (ms;)