Rule History

alert tls any any -> any any (msg: "TOOLS [PTsecurity] loophole tunneling tool TLS request"; flow: established, to_server; tls.sni; content: "api.loophole.cloud"; nocase; threshold: type limit, track by_src, count 1, seconds 300; reference: url, loophole.cloud; reference: url, rules.ptsecurity.com; classtype: attempted-admin; sid: 10012975; rev: 1;)