alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Possible MSN Worm Exploit php"; flow:established; content:"X-MMS-IM-"; depth:153; content:"http"; nocase; content:".php"; nocase; classtype:misc-activity; sid:2002322; rev:4; metadata:created_at 2010_07_30, signature_severity Unknown, updated_at 2019_07_26;)