IPS Signature to protect SMTP Submission

Hello.

We've configured a custom signature to detect Login Brute Force Attack against SMTP service:

F-SBID( --attack_id 9419; --name "SMTP.Login.Brute.Force.Custom"; --protocol tcp; --flow from_server,reversed; --pattern "Authentication failed";--no_case; --context packet; --distance 4,context; --within 40,context; --rate 5,30; --track dst_ip; )

It is include into our IPS profile. We're using SSL inspection profile (protection ssl server).

That signature works fine for SMTP (port 25) and SMTPS (port 465), but it doesn't work for SMTP submission (port 587, encrypted of course).

Anyone has configured a custom signature to protect SMTP submission?

Thank you!