host=192.168.0.1

name=Blame Attack 1
type=protocol
proto=tcp
host_port=5551
attacker_port=any
attacker=any
to_host="Now I own your computer"

name=Blame Attack 2
type=tcp_stream
host_port=5551
attacker_port=any
attacker=any
to_host="Now I own your computer"

name=Blame Attack 3
type=tcp_stream
host_port=5551
attacker_port=any
attacker=any
to_host="\x90{10}.*\xcd\x80"

name=Plaintext POP
type=protocol
proto=tcp
host_port=110
attacker_port=any
attacker=any
from_host="\+OK.*\r\n"
to_host="USER .*\r\n"
from_host="\+OK.*\r\n"
to_host="PASS.*\r\n"
from_host="\+OK.*\r\n"

name=XMAS scan
type=protocol
proto=tcp
host_port=any
attacker_port=any
attacker=any
to_host=".*" with flags=FUP

name=NULL scan
type=protocol
proto=tcp
host_port=80
attacker_port=any
attacker=any
to_host=".*" with flags=

name=TFTP remote boot
type=protocol
proto=udp
host_port=any
attacker_port=69
attacker=any
from_host="vmlinuz"
to_host="\x00\x03\x00\x01"