For Network IPS appliances, use Perl compatible regular expressions (PCRE) keywords to write rules for OpenSignatures.
alert tcp any any -> any any (pcre:"""/GOO/i""";)
alert tcp any any -> any any (pcre:"""/GET.*\.htm/i""";)
alert tcp any any -> any 80 (msg:"""Google image
search""";pcre:"""/Host\:\simages.google.com\r\n/ism""";sid:1000;)
alert tcp any any -> any 80 (msg:"""Gator Agent Traffic""";content:!"""User-Agent\:Akregator""";pcre:"""/User-Agent\:[^\n]+Gator/i""";sid:1000;)
alert tcp any any -> any 80 (msg:"""Yahoo Mail Login""";content:"""yahoo""";pcre:"""/(Host\:)\s[a-zA-Z0-9.-]+(\.mail.yahoo.com\r\n) /ism""";sid:1000;)