alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET SHELLCODE Possible UTF-16 encoded Shellcode Detected"; flow:from_server,established; content:"%u"; nocase; isdataat:4; content:!"|0A|"; within:4; content:!"|20|"; within:4; pcre:"/(%U([0-9a-f]{4})){6}/i"; classtype:trojan-activity; sid:2003174; rev:8; metadata:created_at 2010_07_30, confidence Medium, signature_severity Major, updated_at 2019_07_26;)