Rule History

alert http any any -> any any (msg: "TOOLS [PTsecurity] RClone tool User-Agent detected"; flow: established, to_server; http.user_agent; content: "rclone/v"; nocase; threshold: type limit, track by_src, count 1, seconds 300; reference: url, github.com/rclone/rclone; reference: url, rclone.org; reference: url, rules.ptsecurity.com; classtype: attempted-admin; sid: 10012967; rev: 1;)