alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED W32.kelvir.HI"; flow:established; content:"X-MMS-IM-"; depth:153; content:"search.php?data="; reference:url,securityresponse.symantec.com/avcenter/venc/data/w32.kelvir.hi.html; classtype:misc-activity; sid:2002325; rev:4; metadata:created_at 2010_07_30, signature_severity Unknown, updated_at 2019_07_26;)