alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433

(msg:"Attack Detected";

flow:to_server,established;

content:"|02|";depth:1;

content:"sa";depth:2;offset:39; nocase;

detection_filter:track_by_src,count 5,seconds 2;)