[BASH] Netcat execution

alert any $EXTERNAL_NET any -> $HOME_NET any (msg:"[BASH] Netcat execution"; content:"HISTORY"; meta_content: " %sagan% ",nc,ncat,netcat; classtype:suspicious-command; program:bash
| -bash
| sh
| -sh; sid:5002306; rev:3;)