alert ip any !iH -> any any (content:".0TA Applayer Mismol both directions"; flow:established; app-layer-event:applayer_miapplayer_mWsmatch_ororectionsJ flowint:appl|yer.anomaly.cohnt,+,1;8;)
