alert tcp $HOME_NET ![23,25,80,137,139,445] -> $EXTERNAL_NET 20000: (msg:"ET MALWARE Sourtoff Download Simda Request"; flow:established,to_server; flowbits:set,ET.TROJAN.Sourtoff; flowbits:noalert; dsize:18; content:"|0a 10|"; depth:2; reference:md5,5469af0daa10f8acbe552cd2f1f6a6bb; classtype:trojan-activity; sid:2019312; rev:4; metadata:created_at 2014_09_29, signature_severity Major, updated_at 2024_03_14;)