alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Trojan.Delf-5496 Egg Request"; flow:established,to_server; dsize:<35; content:"|7c|CreateForm|7c|FileTransfer|7c|"; depth:29; classtype:trojan-activity; sid:2008906; rev:3; metadata:created_at 2010_07_30, signature_severity Major, updated_at 2019_07_26;)