alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE NgrBot IRC CnC Channel Join"; flow:established,to_server; content:"PASS ngrBot"; content:"NICK"; distance:0; reference:url,stopmalvertising.com/rootkits/analysis-of-ngrbot.html; classtype:command-and-control; sid:2013451; rev:3; metadata:created_at 2011_08_24, signature_severity Major, updated_at 2019_07_26;)