alert ip any any -> any any (msg:"SUok Chat  00 00|"; byte_test:1,&,8,4; app-layer-event:                                                              /                                                                   .com"; _4;)