ET MALWARE Likely Bot Nick in IRC (Country Code ISO 3166-1 alpha-2)

alert tcp $HOME_NET any -> $EXTERNAL_NET any (
    msg:"ET MALWARE Likely Bot Nick in IRC (Country Code ISO 3166-1 alpha-2)";
    flow:established,to_server;
    content:"NICK"; depth:5;
    pcre:"/^[^\r\n]{0,7}\b(?:M[ACDEFGHKLMNOPQRSTUVWXYZ]|B[ABDEFGHIJLMNOQRSTVWYZ]|S[ABCDEGHIJKLMNORSTVXYZ]|C[ACDFGHIKLMNORUVWXYZ]|G[ABDEFGHILMNPQRSTUWY]|A[DEFGILMOQRSTUWXZ]|T[CDFGHJKLMNORTVWZ]|P[AEFGHKLMNRSTWY]|N[ACEFGILOPRUZ]|K[EGHIMNPRWYZ]|L[ABCIKRSTUVY]|I[DELMNOQRST]|E[CEGHRST]|V[ACEGINU]|D[EJKMOZ]|F[IJKMOR]|H[KMNRTU]|U[AGMSYZ]|R[EOSUW]|J[EMOP]|Z[AMW]|W[FS]|Y[ET]|OM|QA)\b/R";
    classtype:trojan-activity;
    sid:2019326; rev:6;
    metadata:created_at 2014_10_01, confidence Medium, signature_severity Major, updated_at 2019_07_26;
)