I am new to snort rules and need a rule that will alert any email from a specific user.. For example:
alert tcp any any -> any 25 (msg:"Target Email Detected"; content:"[email protected]"; fast_pattern:only; nocase; classtype: Target Email Detected ;sid:12345 ;)
This rule as of now will sniff it if it is in the content, but mail from the email above is not alerted.