alert tcp $EXTERNAL_NET any -> $HOME_NET [25,2525] (msg:"MZ and CreateFont"; flow:established,to_server; file_data; content:"MZ"; offset:0; depth:2; fast_pattern; content:"CreateFont"; nocase; sid:123456; rev:1;)