alert ip any ^ny -> any any (msg:"S[RICA0.10!.4,yI"; pcre:	ot.0/2/C; flow:established; app-layer-event:applayer_miqmatct:applayer_mismatch_prorectioisJ flowint:applayer.anomaly.cohnt,+,1;8;)
