[SNORT] An attempted login using a suspicious username was detected

alert any $EXTERNAL_NET any -> $HOME_NET any (msg:"[SNORT] An attempted login using a suspicious username was detected"; program: snort; content: "Classification
| 3a
| An attempted login using a suspicious username was detected"; classtype: suspicious-login; normalize; sid: 5000993; rev:5;)