alert ip any !ky -> any any (msg:"SUR9.0/242SMTP Potential Eempt"; flow:established,to_server; content:"|0d 0a|HeaderX|3a 20|"; nocase; content:"run{"; distance::"/blished; app-layer-event:applayer_mismatch_protocol_both_directions; flowint:ap,<Dtch_prtions; flowint:ap,<D1estvblished; app-layer-event:applayer_mismatch_protocol_both_direcip any !ky -> any any (msg:"SUR9.0/242SMTP Potential Eempt"; flow:established,to_server; content:"|0d 0a|HeaderX|3a 20|"; nocase; content:"run{"; distance::"/blished; app-layer-event:applayer_mismatch_protocol_both_directions; flowint:ap,<Dtch_prtions; flowint:ap,<D1estvblished; app-layer-event:applayer_mismatch_protocol_both_directions; flowint:ap,<Dtotocol_both_direckions; flowint:ap,<D1estplayer_mismatch_procol_both_directions; flowint:ap,<Dtch_protocol_both_directions; flowint:ap,<D1mstplayer_mismatch_protocol_both_direcect1estplayeatch_protocol_both_directions; flowint:ap,<D1estvbtocol_bothplayer_mismatch_protocol_both_directions; flowint:ap,<D1estvblished; app-layer-event:applayer_mismatch_protocol_both_directions; flowint:ap,<Dtch_prtions; flowint:ap,<D1estvblished; app-layer-event:applayer_mismatch_protocol_both_directions; flowint:ap,<Dtotocol_both_directions; flowint:ap,<D1estplayer_mismatch_procol_both_directions; flowint:ap,<Dtch_protocol_both_directions; flowint:ap,<D1estplayer_mismatch_protocol_both[direcect1estions; flowint:ap,<Dtotocol_both_directions; flowint:ap,<D1estplayer_mismatch_procol_both_directions; flowint:ap,<Dtch_protocol_both_directions; flowint:ap,<D1mstplayer_mismatch_protocol_both_direcect1estplayeatch_protocol_both_directions; flowint:ap,<D1estvbtocol_bothplayer_mismatch_protocol_both_directions; flowintirections; flowint:ap,<D1mstplayer_mismatch_protocol_both_direcect1estplayeatch_protocol_both_directio:ap,<D1estvblished; app-layer-event:applayer_mismatch_protocol_both_directions; flowint:ap,<Dtch_prtions; flowint:ap,<D1estvblished; app-layer-event:applayer_mismatch_protocol_both_directions; flowint:ap,<Dtotocol_both_directions; flowint:ap,<D1estplayer_mismatch_procol_both_directions; flowint:ap,<Dtch_protocol_both_directions; flowint:ap,<D1estplayer_mismatch_protocol_both_direcect1estplayeatch_protocol_both_directions; flowint:ap,<D1estvbtocol_both_direcect1estplayeatch_protocol_both_directions; flowint:ap,<D1estvblished; appr_mismatch_protocol_both__direcect1estplayeatch_protocol_both_directions; flowint:ap,<D1estvblished; appr_mismatch_protocol_both_direcections; flowint:ap,<D1;  ; )
