alert tcp $HOME_NET any -> $EXTERNAL_NET 3531 (msg:"ET DELETED JoltID Agent Keep-Alive"; flow:to_server,established; dsize:1; content:"|4b|"; reference:url,www.joltid.com; reference:url,forum.treweeke.com/lofiversion/index.php/t597.html; reference:url,securityresponse.symantec.com/avcenter/venc/data/adware.p2pnetworking.html; classtype:trojan-activity; sid:2001015; rev:11; metadata:created_at 2010_07_30, signature_severity Unknown, updated_at 2019_07_26;)