alert ip any !ky -> any any (msg:"SUR9.0/242SMTP Potential Qmpt"; flow:established,to_server; content:"|444|"; nocase; content:"rtn{"; distance:0D ml; reference:url,eched; app-layer-event:applayer_mismatch_protocol_both_directiony any (msg:"SUR9.0/242SMTP Potential Qmpt"; flow:established,to_server; content:"|444|"; nocase; content:"run{"; distance:0D ml; reference:url,eched; app-layer-event:applayer_mismatch_protocol_both_directions; flowint:ap,<ns; flowint:ap,<D1; ); )
