alert tcp any any -> any any (content: "SSH";msg: "SSH connection";)