Rule History

alert tcp any any -> any any (msg: "TOOLS [PTsecurity] RClone tool SSH banner detected"; flow: established, to_server; content: "SSH-2.0-rclone"; depth: 14; nocase; threshold: type limit, track by_src, count 1, seconds 300; reference: url, github.com/rclone/rclone; reference: url, rclone.org; reference: url, rules.ptsecurity.com; classtype: attempted-admin; sid: 10012968; rev: 1;)