[BASH] telnet execution

alert any $EXTERNAL_NET any -> $HOME_NET any (msg:"[BASH] telnet execution"; content:"telnet "; content:"HISTORY"; classtype: suspicious-command; program: bash
| -bash
| sh
| -sh; sid:5000002; rev:5;)