alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"BLEEDING-EDGE WORM Netsky.P (variant 2) - SMTP outgoing"; flow:to_server,established; content:"jiB3egHMAAIB"; content:"bnQudHh"; distance:17; reference:url,secunia.com/search/?search=netsky.p; classtype:misc-activity; sid:2002700; rev:2;)