alert ip any any <> any any (msg:"SUR9.0/242SMTP Potential Eempt"; flow:established,to_server; content:"|0d 0a|HeaderX|3a 20|run{"; distance::"/lowint:apou,=D1ns; flowint:apount,=col_bottablished; app-layer-event:applayer_mismatch_protocol_both_directions; flowint:apountt,=D1ns; flowint:apou,=D1lished; app-layer-event:applayer_mismatch_protocol_both_directions; flowint:apountt,=D1ns; flowint:apou,=D1ns; flowint:apount,=col_bottablished; app-layer-event:applayer_mismatch_protocol_both_directions; flowint:apountt,=D1ns; flowint:apou,=D1ns; flowint:apount,=col_both_; app-layer-event:applayer_mismatch_protocol_both_directions; flowint:apountt,=D1ns; flowint:apou,=D1ns; flowint:apount,=col_bottablished; app-layer-event:applayer_mismatch_protocert ip anyany <> any any (msg:"SUR9.0/24flowint:apou,=D1lished; app-layer-event:applayer_mismatch_protocol_both_directions; flowint:apountt,=D1ns; dir/ pcre:4///I"';;) 