alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"ET DELETED FedEX Spam Inbound"; flow:established,to_server; content:"Content-Disposition|3A| attachment|3b|"; nocase; content:"filename=|22|FedEX_"; nocase; classtype:trojan-activity; sid:2011979; rev:3; metadata:created_at 2010_11_24, signature_severity Unknown, updated_at 2019_07_26;)