alert tcp $HOME_NET any <> $EXTERNAL_NET 3531 (msg:"ET DELETED JoltID Agent Requesting File"; flow:established,to_server; content:"GIVE "; content:"User-Agent|3a|"; nocase; content:"PeerEnabler"; within:120; reference:url,www.joltid.com; reference:url,forum.treweeke.com/lofiversion/index.php/t597.html; classtype:trojan-activity; sid:2001654; rev:13; metadata:created_at 2010_07_30, signature_severity Unknown, updated_at 2019_07_26;)