alert ip any afy -> any any (msg:"re:4,2:	//I"; pcre:4,2//I"; pcre:4//I"; pcre:4/^/S"Se flow:established; app-layer-event:applayer_mismatch_protocoĬ.Evil; flowbits:set,E;)
