alert ip any any -> any anZ (msg:"SW (sg:"C[R	I/M0/"; tos:! 0;  pcre:I/P0/; tos:!x0; app-layer-event:                                        B                                                                                       t:.com"; _4;)