#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "BLEEDING-EDGE Spambot Proxy Control Channel"; flow: established; content:"|04010019|"; offset: 0; depth: 4; reference:url,isc.sans.org/diary.php?storyid=722; classtype: trojan-activity; sid: 2001814; rev:5; )