alert tcp ( sid:1200006;  msg:"Custom SD Pattern NINOs"; sd_pattern:"(?ms)(\b(?:^(?!BG)(?!GB)(?!NK)(?!KN)(?!TN)(?!NT)(?!ZZ)(?:[A-CEGHJ-PR-TW-Z][A-CEGHJ-NPR-TW-Z])(?:\s*\d\s*){6}(?:[A-D]|\s))\b.*?)",threshold 10; service:http,ftp,smtp,imap,pop3; classtype:sdf; rev:1; )