alert smtp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Dridex e-mail inbound"; flow:established,to_server; content:"<no-replay"; fast_pattern; content:"User-Agent|3a 20|Roundcube"; classtype:bad-unknown; sid:2020351; rev:3; metadata:created_at 2015_02_03, confidence Medium, signature_severity Major, updated_at 2024_03_07;)