alert smtp $HOME_NET any <> any any (msg:"ET HUNTING Possible Kobold Letters CSS in Email M2"; flow:established; content:"display|3a|block|21|important|3b|"; fast_pattern; reference:url,lutrasecurity.com/en/articles/kobold-letters/; classtype:misc-activity; sid:2051944; rev:2; metadata:attack_target SMTP_Server, created_at 2024_04_04, deployment Perimeter, performance_impact Moderate, confidence Low, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_04_26;)