Example

    alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP PORT bounce attempt"; \
        flow:to_server,established; content:"PORT"; nocase; ftpbounce; pcre:"/^PORT/smi";\
        classtype:misc-attack; sid:3441; rev:1;)