alert smtp $HOME_NET any <> any any (msg:"ET HUNTING Possible Kobold Letters CSS in Email M1"; flow:established; content:"display|3a 20|block|20 21|important|3b|"; fast_pattern; reference:url,lutrasecurity.com/en/articles/kobold-letters/; classtype:misc-activity; sid:2051943; rev:2; metadata:attack_target SMTP_Server, created_at 2024_04_04, deployment Perimeter, performance_impact Moderate, confidence Medium, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_04_26;)