alert tcp any any <> $HOME_NET any (msg:"RECON Nmap-Xmas-scan"; flags:FPU; sid: 1000001; rev:1;)
alert tcp any any <> $HOME_NET any (msg:"RECON Nmap-FIN-scan"; flags:F; sid: 1000002; rev:1;)
alert tcp any any <> $HOME_NET any (msg:"RECON Nmap-NULL-scan"; flags:0; sid: 1000003; rev:1;)
alert tcp any  any <> $HOME_NET 22 (msg: RECON SSH-scan";  flags: S; flowbits: set,ssh.brute.attempt; detection_filter: track by_src, count 5, seconds 120; sid: 1000004; rev:1;)
alert tcp any any <> $HOME_NET [80,443] (msg:"RECON NIKTO-Scan";flow:to_server,established;detection_filter: track by_src, count 40, seconds 10;pcre:"/((\%3C)|<)((\%2F)|\/)*[a-z0-9\%]+((\%3E)|>)/ix"; sid:1000005; rev:1;)
alert tcp any any <> $HOME_NET 80 (flags: S; msg:"DOS attempt"; flow: stateless; detection_filter: track by_src, count 70, seconds 10; sid:1000006; rev:1;)
alert tcp any any <> $HOME_NET any (msg:”BFA SQL-Injection”; pcre:"/w*((%27)|(‘))((%6F)|o|(%4F))((%72)|r|(%52))/ix"; sid:1000007; rev:1;)
alert tcp any any <> $HOME_NET 443 (flags: S; msg:"BFA attack"; flow: stateless; detection_filter: track by_src, count 70, seconds 10; sid:1000008; rev:1;)
alert icmp any any <> $HOME_NET any (msg:"RECON Ping-Sweep"; detection_filter: track by_src, count 40, seconds 10;sid: 1000009; rev:1; 
