regular:
alert tcp $HOME_NET any -> $EXTERNAL_NET !6666:7000 (msg:"ET TROJAN IRC Nick change on non-standard port"; flow:to_server,established; dsize:<64; content:"NICK "; depth:5; reference:url,doc.emergingthreats.net/bin/view/Main/2000345; classtype:trojan-activity; sid:2000345; rev:15;)

enhanced:
alert tcp $HOME_NET any -> $EXTERNAL_NET !6666:7000 (msg:"ET TROJAN IRC Nick change on non-standard port"; flow:to_server,established; dsize:<64; content:"NICK "; depth:5; reference:url,doc.emergingthreats.net/bin/view/Main/2000345; classtype:trojan-activity; sid:2000345; rev:15; metadata:created_at 2010_07_30, updated_at 2010_07_30;)